PT-2026-79322

CVE-2026-59799

Published

2026-08-21

Updated

2026-08-27

Description by

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache CloudStack versions 4.18.0.0 through 4.20.3.0 Apache CloudStack versions 4.21.0.0 through 4.22.1.0

Description Improper Privilege Management in the Two-factor authentication plugin allows for the bypass of the two-factor authentication disable flow.

Recommendations Upgrade versions 4.18.0.0 through 4.20.3.0 to 4.20.3.1 or later. Upgrade versions 4.21.0.0 through 4.22.1.0 to 4.22.1.1 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Erichen

Vendors

Affected products

Weakness enumeration

CWE-269: Improper Privilege Management

Related identifiers