CVE-2026-61400: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection') in Apache Software Foundation Apache CloudStack

This vulnerability (CVE-2026-61400) in Apache CloudStack arises from improper neutralization of special elements in commands (CWE-77) within the run and get diagnostics functionality for system VMs and virtual routers. An authenticated user with admin role permissions invoking the getDiagnosticsData or runDiagnostics APIs can achieve arbitrary command execution on the system VM or virtual router instances. Commands execute with root privileges or at least as the diagnostics-process user, enabling full compromise of the affected instance. This can lead to lateral movement within the CloudStack-managed infrastructure and access to guest network traffic handled by the compromised virtual router. The affected versions include 4.20.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. The issue is fixed in versions 4.20.3.1 and 4.22.1.1.

Successful exploitation allows an authenticated admin user to execute arbitrary commands as root or diagnostics-process user on system VMs or virtual routers, resulting in full compromise of those instances. This can lead to lateral movement within the CloudStack infrastructure and unauthorized access to guest network traffic. The vulnerability has a high CVSS score of 8.8, indicating a high impact on confidentiality, integrity, and availability.

A fix is available. Users should upgrade Apache CloudStack to version 4.20.3.1 or 4.22.1.1 or later to remediate this vulnerability. The getDiagnosticsData and runDiagnostics APIs are restricted to admin role accounts by default, which limits exposure to authorized users only. Patch status is confirmed by the vendor advisory.