CVE-2026-61400: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection') in Apache Software Foundation Apache CloudStack

CVE-2026-61400 is a command injection vulnerability in Apache CloudStack's run and get diagnostics functionality affecting system VMs and virtual routers. Authenticated users with admin role permissions to call getDiagnosticsData or runDiagnostics APIs can execute arbitrary commands with elevated privileges, resulting in full compromise of the affected instance. This may allow attackers to move laterally within the CloudStack-managed environment and access guest network traffic handled by compromised virtual routers. The issue affects Apache CloudStack versions from 4.20.0.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. Upgrading to versions 4.20.3.1 or 4.22.1.1 or later mitigates the vulnerability.

Successful exploitation allows an authenticated admin user to execute arbitrary commands as root or diagnostics-process user on system VMs or virtual routers, leading to full compromise of those instances. This can result in unauthorized control over affected infrastructure components and potential lateral movement within the CloudStack environment, including access to guest network traffic handled by compromised virtual routers.

Users should upgrade Apache CloudStack to version 4.20.3.1 or 4.22.1.1 or later, where this vulnerability is fixed. The affected APIs are restricted to admin role accounts by default, limiting exposure to authorized users only. Patch status is confirmed by the vendor advisory recommending these versions.