InfoSecBulletin Cybersecurity for mankind
The Apache Software Foundation has warned about two serious security issues (CVE-2024-38346 and CVE-2024-39864) in Apache CloudStack, a popular open-source cloud computing platform. These vulnerabilities are a big threat to organizations using CloudStack to manage their virtualized infrastructure.
Unauthenticated Cluster Service Port (CVE-2024-38346)
Daily Cyber security update for 25. 10. 2026
Daily Cyber security update for 24. 10. 2026
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
Trump says data centres should pay dividends to local community
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
The vulnerability CVE-2024-38346 is found in the unauthenticated CloudStack cluster service port (default 9090). It can be exploited by attackers to run commands on hypervisors and CloudStack management servers. This could lead to full control over the CloudStack environment, causing data breaches, service disruptions, and financial losses.
Dynamic Port Assignment in Disabled Integration API Service (CVE-2024-39864)
The CVE-2024-39864 vulnerability affects the CloudStack integration API service. Although it should not be accessible when disabled, it mistakenly listens on a random port. Attackers who can access the CloudStack management network can find this port and use it to perform unauthorized administrative actions and execute remote code on CloudStack managed hosts. This vulnerability increases the risk of a complete infrastructure compromise.
Affected Versions and Urgent Call for Action
Apache CloudStack versions 4.0.0 to 4.18.2.0 and 4.19.0.0 to 4.19.0.1 have serious security flaws. The best way to fix this is to update to versions 4.18.2.1 or 4.19.0.2, which include patches to address these issues.
For organizations unable to upgrade immediately, the following temporary measures are advised:
Limit network access to the cluster service port (default 9090) on CloudStack management server hosts to only their peer management servers. Also, restrict network access on CloudStack management server hosts to only essential ports.
