Improper Output Encoding Vulnerability in Apache CloudStack User Interface

CVE-2026-61399

What is CVE-2026-61399?

An improper output encoding vulnerability exists in the user interface of Apache CloudStack, particularly while utilizing the Lock User functionality. This flaw allows for potential exploitation, enabling attackers to manipulate output data improperly. Affected versions include Apache CloudStack from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users should upgrade to version 4.20.3.1 or 4.22.1.1 or later to mitigate this risk and ensure their systems are secure.

References