GCVE-110-NCSC-2026-332

Advisory PublishedCVSS 8.1/10

Vulnetix · Advisory published August 27, 2026

Apache CloudStack versions 4.20.0.0 to 4.20.3.0 and 4.21.0.0 to 4.22.1.0 contain an OS Command Injection vulnerability in the NAS backup provider plugin allowing arbitrary command execution on KVM hypervisor hosts during backup restore.

Download JSON Open in Console

Weaknesses (CWE)

CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')CWE-862Missing AuthorizationCWE-918Server-Side Request Forgery (SSRF)CWE-312Cleartext Storage of Sensitive InformationCWE-116Improper Encoding or Escaping of OutputCWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')CWE-347Improper Verification of Cryptographic Signature

Risk Scores

CVSS 3.1

8.1/10

High · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
Apache Software Foundation	vers:unknown/*	—	—

Aliases

CVE-2026-47359 CVE-2026-50112 CVE-2026-50222 CVE-2026-59085 CVE-2026-59655 CVE-2026-59657 CVE-2026-59780 CVE-2026-59799 CVE-2026-61397 CVE-2026-61398 CVE-2026-61399 CVE-2026-61400 CVE-2026-61422 CVE-2026-62440 CVE-2026-65613 CVE-2026-66721 CVE-2026-66722 CVE-2026-66797 CVE-2026-68745

References

advisory

Browse GCVE Records

867 records in the GCVE database · Updated September 2, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON