CVE-2026-61400

*** Pendiente de traducción *** Improper Neutralization of Special Elements used in a Command (&amp;#39;Command Injection&amp;#39;) vulnerability in Apache CloudStack&amp;#39;s run and get diagnostics functionality for the system VMs and virtual routers.<br /> <br /> An authenticated user holding the permissions required to invoke either `getDiagnosticsData` or `runDiagnostics` can achieve arbitrary command execution on the system VM and/or Virtual Router instances, with commands running as root (or as the diagnostics-process user, at minimum). This represents a full compromise of the affected instance and, depending on network segmentation, may provide a foothold for lateral movement within the CloudStack-managed infrastructure, including access to guest network traffic handled by the compromised Virtual Router.<br /> <br /> <br /> <br /> The getDiagnosticsData and runDiagnostics APIs are restricted to only Admin role accounts by default.<br /> <br /> <br /> This issue affects Apache CloudStack: from 4.20.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.<br /> <br /> Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.