CVE-2026-61398
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Instance Reset Password functionality. Affects versions from 4.15.1.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.
Risk Assessment
May lead to XSS attacks, allowing malicious script execution in an administrator's browser and potential session theft.
Recommendation
Upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.
Original NVD description (English source)
Improper Encoding or Escaping of Output vulnerability in Apache CloudStack's UI while using Instance Reset Password functionality. This issue affects Apache CloudStack: from 4.15.1.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.