CVE-2025-47849: Privilege Escalation in Apache CloudStack

This vulnerability allows a malicious Domain Admin user to escalate their privileges within the CloudStack environment. By obtaining the API keys of Admin role user-accounts, the attacker can effectively impersonate these accounts and access sensitive APIs and resources. This could lead to unauthorized modification or deletion of virtual machines, storage volumes, and network configurations. The potential impact extends to data exfiltration, denial of service attacks, and complete compromise of the CloudStack infrastructure. The ability to assume Admin privileges significantly broadens the attacker's blast radius, potentially affecting all resources managed within the domain.

1. Reserved2025-05-12
2. Published2025-06-10
3. Modified2026-02-26
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-47849 is to upgrade Apache CloudStack to version 4.20.1.0 or later, which contains the fix. If an immediate upgrade is not feasible, consider implementing stricter access controls and monitoring API key usage. Implement multi-factor authentication (MFA) for all administrative accounts to add an extra layer of security. Review CloudStack configuration to ensure the principle of least privilege is enforced, limiting Domain Admin access to only necessary resources. After upgrade, confirm the fix by attempting to access Admin APIs with a Domain Admin account and verifying that access is denied.