Back Ciberseguridadlatam

Inyección de comandos en Apache CloudStack permite a operadores ejecutar código en hipervisores KVM

Ciberseguridadlatam •Redacción CSL • August 23, 2026

Una falla en el plugin de backup NAS expone a cuentas con privilegios de operador la capacidad de comprometer hosts de virtualización durante restauraciones. Apache CloudStack acaba de parchear una vulnerabilidad de inyección de comandos (CVE-2026-47359) que permite a una cuenta de operador malicioso ejecutar código arbitrario en hosts hipervisores KVM. La falla reside en […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Apache CloudStack Command Injection Vulnerability Exposes KVM Hypervisors A command injection vulnerability (CVE-2026-47359) in Apache CloudStack's NAS backup plugin has been patched. This flaw allows malicious operator accounts to execute arbitrary code on KVM hypervisors during restoration processes. The vulnerability was published on 2026-08-21 and affects operator accounts with elevated privileges. The risk is particularly significant as it could lead to the compromise of virtualized hosts. Apache CloudStack has released a patch to address this issue, and users are advised to update their systems promptly. The vulnerability highlights the importance of securing backup plugins in virtualization environments. 2 sources 58

Extracted Entities

Inyección de comandos en Apache CloudStack permite a operadores ejecutar código en hipervisores KVM

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (2)