Vulnerability Details CVE-2026-59799
Improper Privilege Management vulnerability in Apache CloudStack's Two-factor authentication plugin allowing bypass of the two-factor authentication disable flow.
This issue affects Apache CloudStack: from 4.18.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.
Users are recommended to upgrade to version 4.20.3.1 or 4.22.1.1 or later, which fixes the issue.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 24.4%
CVSS Severity
CVSS v3 Score 8.8
Products affected by CVE-2026-59799
-
cpe:2.3:a:apache:cloudstack:4.18.0.0
-
cpe:2.3:a:apache:cloudstack:4.18.1.0
-
cpe:2.3:a:apache:cloudstack:4.18.1.1
-
cpe:2.3:a:apache:cloudstack:4.18.2.0
-
cpe:2.3:a:apache:cloudstack:4.18.2.1
-
cpe:2.3:a:apache:cloudstack:4.18.2.2
-
cpe:2.3:a:apache:cloudstack:4.18.2.3
-
cpe:2.3:a:apache:cloudstack:4.18.2.4
-
cpe:2.3:a:apache:cloudstack:4.18.2.5
-
cpe:2.3:a:apache:cloudstack:4.19.0.0
-
cpe:2.3:a:apache:cloudstack:4.19.0.1
-
cpe:2.3:a:apache:cloudstack:4.19.0.2
-
cpe:2.3:a:apache:cloudstack:4.19.1.0
-
cpe:2.3:a:apache:cloudstack:4.19.1.1
-
cpe:2.3:a:apache:cloudstack:4.19.1.2
-
cpe:2.3:a:apache:cloudstack:4.19.1.3
-
cpe:2.3:a:apache:cloudstack:4.19.2.0
-
cpe:2.3:a:apache:cloudstack:4.19.3.0
-
cpe:2.3:a:apache:cloudstack:4.20.0.0
-
cpe:2.3:a:apache:cloudstack:4.20.1.0
-
cpe:2.3:a:apache:cloudstack:4.20.2.0
-
cpe:2.3:a:apache:cloudstack:4.20.3.0
-
cpe:2.3:a:apache:cloudstack:4.21.0.0
-
cpe:2.3:a:apache:cloudstack:4.22.0.0
-
cpe:2.3:a:apache:cloudstack:4.22.0.1
-
cpe:2.3:a:apache:cloudstack:4.22.1.0