Known vulnerabilities in Apache CloudStack

Vendor: Apache Foundation
Software: Apache CloudStack
Software CPE: cpe:2.3:a:apache_foundation:apache_cloudstack:*:*:*:*:*:*:*:*
Website: https://www.apache.org
Total vulnerabilities: 11
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.4

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Apache CloudStack Apache CloudStack is affected by 11 known vulnerabilities: 1 high, 5 medium, 5 low Critical High Medium Low

Vulnerabilities (11)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU131150 - Improper Authorization
CVE-2025-66170		 CWE-285 Low
No
No
 4.22.0.1 12.05.2026 SB2026051261
#VU131151 - Improper Access Control
CVE-2025-66171		 CWE-284 Low
No
No
 4.22.0.1 12.05.2026 SB2026051261
#VU131152 - Improper Access Control
CVE-2025-66172		 CWE-284 Low
No
No
 4.22.0.1 12.05.2026 SB2026051261
#VU131153 - Improper Access Control
CVE-2025-66467		 CWE-284 Low
No
No
 4.20.3.0, 4.22.0.1 12.05.2026 SB2026051261
#VU131154 - Time-of-check Time-of-use (TOCTOU) Race Condition
CVE-2025-69233		 CWE-367 Medium
No
No
 4.20.3.0, 4.22.0.1 12.05.2026 SB2026051261
#VU131155 - Command injection
CVE-2026-25077		 CWE-77 Medium
No
No
 4.20.3.0, 4.22.0.1 12.05.2026 SB2026051261
#VU131156 - Improper Access Control
CVE-2026-25199		 CWE-284 Medium
No
No
 4.22.0.1 12.05.2026 SB2026051261
#VU118824 - Improper Control of Generation of Code ('Code Injection')
CVE-2025-59302		 CWE-94 Medium
No
No
 4.20.2.0, 4.22.0.0 28.11.2025 SB2025112810
#VU118823 - Improper Access Control
CVE-2025-59454		 CWE-284 Medium
No
No
 4.20.2.0, 4.22.0.0 28.11.2025 SB2025112810
#VU105110 - Improper Access Control
CVE-2025-22828		 CWE-284 Low
No
No
 - 28.02.2025 SB2025022805
#VU100517 - Improper Privilege Management
CVE-2024-50386		 CWE-269 High
No
No
 4.18.2.5, 4.19.1.3 15.11.2024 SB2024111508