CVE-2026-59654: 
Apache CloudStack vulnerability analysis and mitigation

CVE-2026-59654 is a Missing Release of Resource after Effective Lifetime vulnerability (CWE-772) in Apache CloudStack's scoped global configuration functionality. It affects multiple modules and plugins of the CloudStack management server — including Quota and Host-HA — and can lead to eventual denial of service (DoS) of the management server. The vulnerability affects Apache CloudStack versions 4.7.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0. It was published on August 21, 2026, with a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 6.8 (Medium) (GitHub Advisory, Apache Mailing List).

The root cause is CWE-772 (Missing Release of Resource after Effective Lifetime): resources allocated during scoped global configuration operations in the CloudStack management server are not properly released after use, causing them to accumulate over time. This resource leak affects multiple server-side modules and plugins, including Quota and Host-HA. An attacker (or even normal operational activity) that repeatedly triggers scoped global configuration changes can accelerate resource exhaustion — consuming memory, file descriptors, or threads — until the management server becomes unavailable. No public proof-of-concept exploit code has been identified (GitHub Advisory, Apache Mailing List).

Successful exploitation results in a denial of service condition for the Apache CloudStack management server, rendering it unavailable to administrators and users managing cloud infrastructure. There is no confidentiality or integrity impact — the vulnerability is limited to availability. Because the CloudStack management server is the central control plane for cloud resource orchestration, its unavailability can disrupt provisioning, monitoring, and management of all hosted virtual machines and services (GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.23–0.33%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. NVD's SSVC assessment classifies exploitation as "none" and the attack as non-automatable, suggesting exploitation requires specific preconditions such as triggering scoped configuration changes (GitHub Advisory).

Apache has released patched versions addressing this vulnerability: 4.20.3.1 (for the 4.x LTS branch) and 4.22.1.1 (for the 4.22 branch). Users running any version from 4.7.0 through 4.20.3.0 or 4.21.0.0 through 4.22.1.0 should upgrade immediately. As a temporary measure, administrators should monitor CloudStack management server resource utilization (memory, file descriptors, threads) for signs of exhaustion and restart the management server if resource depletion is observed (GitHub Advisory, Apache Mailing List).