CVE-2026-59085

CriticalCVSS 9.1

Published: 21/08/2026(UTC)Updated: 25/08/2026(UTC)Translated: 21/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.14%

4th percentile - higher than 4% of all known CVEs

Summary

Server-Side Request Forgery (SSRF) vulnerability in Apache CloudStack's webhook module, exploitable via webhook delivery requests. Affects versions from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.

Risk Assessment

An attacker can make requests to internal network resources, potentially leading to data exposure or further attacks.

Recommendation

Upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.

Original NVD description (English source)

Server-Side Request Forgery (SSRF) vulnerability in Apache CloudStack's webhook module, exploitable via webhook delivery requests. This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.