Apache CloudStack Command Injection Vulnerability Exposes KVM Hypervisors

Ciberseguridadlatam

Apache CloudStack Command Injection Vulnerability Exposes KVM Hypervisors

First seen 23 Aug 2026, 16:16 UTC • •57.8

Article Content

1 / 3

Browse articles

ThreatCluster •August 24, 2026 at 15:51 UTC

•CVE-2026-47359 allows command injection via the NAS backup plugin in Apache CloudStack.
•Malicious operators can execute arbitrary code on KVM hypervisors during restoration.
•A patch has been released; users are urged to update their systems immediately.

A command injection vulnerability (CVE-2026-47359) in Apache CloudStack's NAS backup plugin has been patched. This flaw allows malicious operator accounts to execute arbitrary code on KVM hypervisors during restoration processes. The vulnerability was published on 2026-08-21 and affects operator accounts with elevated privileges. The risk is particularly significant as it could lead to the compromise of virtualized hosts. Apache CloudStack has released a patch to address this issue, and users are advised to update their systems promptly. The vulnerability highlights the importance of securing backup plugins in virtualization environments.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 48d ago How this analysis works

Timeline

2026-08-21

CVE-2026-47359 published

Apache CloudStack disclosed a command injection vulnerability affecting the NAS backup plugin.

Ciberseguridadlatam

2026-08-23

Vulnerability patched

Apache CloudStack released a patch to mitigate the command injection vulnerability affecting KVM hypervisors.

Ciberseguridadlatam

More articles in this cluster (2)

Threat Graph

7 entities, 9 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (3)

Command Injection
Zero-day Exploit
T1059 - Command and Scripting Interpreter

Vulnerability (1)

CVE-2026-47359

Weakness (1)

CWE-78 - OS Command Injection

Affected Platform (2)

Apache CloudStack
KVM

Relationships

CVE-2026-47359 targets Apache CloudStack
CVE-2026-47359 targets KVM
Command Injection targets Apache CloudStack
Command Injection targets KVM
Zero-day Exploit targets Apache CloudStack
Zero-day Exploit targets KVM
T1059 - Command and Scripting Interpreter targets Apache CloudStack
T1059 - Command and Scripting Interpreter targets KVM
CVE-2026-47359 related to CWE-78 - OS Command Injection

Following this threat?

Track CVE-2026-47359 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active…

CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…