Instances deployed via the Proxmox extension allow unauthorized access to instances belonging to other tenants. This issue affects Apache CloudStack: from 4.21.0.0 through 4.22.0.0. The Proxmox extension for CloudStack improperly uses a user-editable instance setting, proxmox_vmid, to associate CloudStack instances with Proxmox virtual machines. Because this value is not restricted or validated against tenant ownership and Proxmox VM IDs are predictable, a non-privileged attacker can modify the setting to reference a VM belonging to another account. This allows unauthorized cross-tenant access and enables full control over the targeted VM, including starting, stopping, and destroying the virtual machine. Users are recommended to upgrade to version 4.22.0.1, which fixes this issue. As a workaround for the existing installations, editing of the proxmox_vmid instance detail by users can be prevented by adding this detail name to the global configuration parameter - user.vm
Casky was already ahead
This CVE exploits attack patterns that Casky's 261matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-25199 is a critical authorization bypass vulnerability in Apache CloudStack's Proxmox extension that allows attackers to access virtual machine instances belonging to other tenants. The flaw stems from improper validation of the proxmox_vmid parameter—a user-editable instance setting that CloudStack uses to map its instances to underlying Proxmox VMs. Since Proxmox VM IDs are predictable and not validated against tenant ownership, a non-privileged attacker can modify this value to gain unauthorized access to instances outside their tenant boundary. This affects CloudStack versions 4.21.0.0 through 4.22.0.0 and represents a severe risk for multi-tenant cloud environments where tenant isolation is fundamental to security and compliance.
Casky's 261 matching skills—powered by Claude AI's extended reasoning—map directly to MITRE ATT&CK techniques TA0043 (Reconnaissance) and TA0009 (Collection), helping practitioners identify the attack chain. Practitioners would see detection signals including: suspicious instance metadata modification attempts targeting proxmox_vmid parameters, cross-tenant API calls with modified VM identifiers, and unauthorized access to instance resources outside expected tenant scope. Casky's skills would correlate these signals with known privilege escalation and data exfiltration patterns, flagging the reconnaissance phase when attackers enumerate predictable Proxmox VM IDs and the collection phase when they access unauthorized instance data. The platform would highlight configuration drift in instance settings and anomalous API patterns that indicate someone is systematically probing tenant boundaries—critical indicators that this vulnerability is being actively exploited in your environment.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-25199.
Casky has 261 skills that investigate the attack patterns behind CVE-2026-25199. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →analyzing-campaign-attribution-evidence
threat intelligence · low
analyzing-certificate-transparency-for-phishing
threat intelligence · low
analyzing-cyber-kill-chain
threat intelligence · low
analyzing-disk-image-with-autopsy
digital forensics · low
analyzing-docker-container-forensics
digital forensics · low
analyzing-email-headers-for-phishing-investigation
digital forensics · low
analyzing-indicators-of-compromise
threat intelligence · low
analyzing-linux-kernel-rootkits
digital forensics · low
analyzing-linux-system-artifacts
digital forensics · low
analyzing-lnk-file-and-jump-list-artifacts
digital forensics · low
analyzing-malware-family-relationships-with-malpedia
threat intelligence · low
analyzing-mft-for-deleted-file-recovery
digital forensics · low
analyzing-outlook-pst-for-email-forensics
digital forensics · low
analyzing-persistence-mechanisms-in-linux
threat hunting · low
analyzing-powershell-empire-artifacts
threat hunting · low
analyzing-prefetch-files-for-execution-history
digital forensics · low
analyzing-ransomware-leak-site-intelligence
threat intelligence · low
analyzing-ransomware-network-indicators
threat hunting · low
analyzing-slack-space-and-file-system-artifacts
digital forensics · low
analyzing-threat-actor-ttps-with-mitre-attack
threat intelligence · low
analyzing-threat-actor-ttps-with-mitre-navigator
threat intelligence · low
analyzing-threat-intelligence-feeds
threat intelligence · low
analyzing-threat-landscape-with-misp
threat intelligence · low
analyzing-typosquatting-domains-with-dnstwist
threat intelligence · low
analyzing-usb-device-connection-history
digital forensics · low
analyzing-windows-amcache-artifacts
digital forensics · low
analyzing-windows-lnk-files-for-artifacts
digital forensics · low
analyzing-windows-prefetch-with-python
digital forensics · low
analyzing-windows-registry-for-artifacts
digital forensics · low
analyzing-windows-shellbag-artifacts
digital forensics · low
auditing-tls-certificate-transparency-logs
threat intelligence · low
automating-ioc-enrichment
threat intelligence · low
building-adversary-infrastructure-tracking-system
threat intelligence · low
building-attack-pattern-library-from-cti-reports
threat intelligence · low
building-c2-infrastructure-with-sliver-framework
red teaming · high
building-ioc-defanging-and-sharing-pipeline
threat intelligence · low
building-ioc-enrichment-pipeline-with-opencti
threat intelligence · low
building-red-team-c2-infrastructure-with-havoc
red teaming · high
building-threat-actor-profile-from-osint
threat intelligence · low
building-threat-feed-aggregation-with-misp
threat intelligence · low
building-threat-hunt-hypothesis-framework
threat hunting · low
building-threat-intelligence-platform
threat intelligence · low
bypassing-authentication-with-forced-browsing
web application security · medium
collecting-open-source-intelligence
threat intelligence · low
collecting-threat-intelligence-with-misp
threat intelligence · low
conducting-api-security-testing
penetration testing · medium
conducting-domain-persistence-with-dcsync
red teaming · high
conducting-external-reconnaissance-with-osint
penetration testing · medium
conducting-full-scope-red-team-engagement
red teaming · high
conducting-internal-network-penetration-test
penetration testing · medium
conducting-internal-reconnaissance-with-bloodhound-ce
red teaming · high
conducting-mobile-app-penetration-test
penetration testing · medium
conducting-network-penetration-test
penetration testing · medium
conducting-pass-the-ticket-attack
red teaming · high
conducting-social-engineering-penetration-test
penetration testing · medium
conducting-social-engineering-pretext-call
red teaming · high
conducting-spearphishing-simulation-campaign
red teaming · high
conducting-wireless-network-penetration-test
penetration testing · medium
correlating-threat-campaigns
threat intelligence · low
detecting-anomalies-in-industrial-control-systems
ot ics security · medium
detecting-attacks-on-historian-servers
ot ics security · medium
detecting-attacks-on-scada-systems
ot ics security · medium
detecting-dcsync-attack-in-active-directory
threat hunting · low
detecting-dll-sideloading-attacks
threat hunting · low
detecting-dnp3-protocol-anomalies
ot ics security · medium
detecting-email-forwarding-rules-attack
threat hunting · low
detecting-golden-ticket-attacks-in-kerberos-logs
threat hunting · low
detecting-insider-threat-behaviors
threat hunting · low
detecting-kerberoasting-attacks
threat hunting · low
detecting-lateral-movement-with-splunk
threat hunting · low
detecting-malicious-scheduled-tasks-with-sysmon
threat hunting · low
detecting-mimikatz-execution-patterns
threat hunting · low
detecting-modbus-command-injection-attacks
ot ics security · medium
detecting-modbus-protocol-anomalies
ot ics security · medium
detecting-ntlm-relay-with-event-correlation
threat hunting · low
detecting-pass-the-hash-attacks
threat hunting · low
detecting-privilege-escalation-attempts
threat hunting · low
detecting-process-hollowing-technique
threat hunting · low
detecting-service-account-abuse
threat hunting · low
detecting-stuxnet-style-attacks
ot ics security · medium
detecting-suspicious-powershell-execution
threat hunting · low
detecting-t1003-credential-dumping-with-edr
threat hunting · low
detecting-t1055-process-injection-with-sysmon
threat hunting · low
detecting-t1548-abuse-elevation-control-mechanism
threat hunting · low
detecting-wmi-persistence
threat hunting · low
evaluating-threat-intelligence-platforms
threat intelligence · low
executing-active-directory-attack-simulation
penetration testing · medium
executing-phishing-simulation-campaign
penetration testing · medium
executing-red-team-engagement-planning
red teaming · high
executing-red-team-exercise
penetration testing · medium
exploiting-active-directory-certificate-services-esc1
red teaming · high
exploiting-active-directory-with-bloodhound
red teaming · high
exploiting-broken-link-hijacking
web application security · medium
exploiting-constrained-delegation-abuse
red teaming · high
exploiting-http-request-smuggling
web application security · medium
exploiting-idor-vulnerabilities
web application security · medium
exploiting-insecure-deserialization
web application security · medium
exploiting-kerberoasting-with-impacket
red teaming · high
exploiting-mass-assignment-in-rest-apis
web application security · medium
exploiting-ms17-010-eternalblue-vulnerability
red teaming · high
exploiting-nopac-cve-2021-42278-42287
red teaming · high
exploiting-nosql-injection-vulnerabilities
web application security · medium
exploiting-oauth-misconfiguration
web application security · medium
exploiting-prototype-pollution-in-javascript
web application security · medium
exploiting-race-condition-vulnerabilities
web application security · medium
exploiting-server-side-request-forgery
web application security · medium
exploiting-sql-injection-vulnerabilities
penetration testing · medium
exploiting-sql-injection-with-sqlmap
web application security · medium
exploiting-template-injection-vulnerabilities
web application security · medium
exploiting-type-juggling-vulnerabilities
web application security · medium
exploiting-websocket-vulnerabilities
web application security · medium
exploiting-zerologon-vulnerability-cve-2020-1472
red teaming · high
extracting-browser-history-artifacts
digital forensics · low
extracting-credentials-from-memory-dump
digital forensics · low
extracting-windows-event-logs-artifacts
digital forensics · low
generating-threat-intelligence-reports
threat intelligence · low
hunting-advanced-persistent-threats
threat intelligence · low
hunting-for-anomalous-powershell-execution
threat hunting · low
hunting-for-beaconing-with-frequency-analysis
threat hunting · low
hunting-for-cobalt-strike-beacons
threat hunting · low
hunting-for-command-and-control-beaconing
threat hunting · low
hunting-for-data-exfiltration-indicators
threat hunting · low
hunting-for-data-staging-before-exfiltration
threat hunting · low
hunting-for-dcom-lateral-movement
threat hunting · low
hunting-for-dcsync-attacks
threat hunting · low
hunting-for-defense-evasion-via-timestomping
threat hunting · low
hunting-for-dns-based-persistence
threat hunting · low
hunting-for-dns-tunneling-with-zeek
threat hunting · low
hunting-for-domain-fronting-c2-traffic
threat hunting · low
hunting-for-lateral-movement-via-wmi
threat hunting · low
hunting-for-living-off-the-cloud-techniques
threat hunting · low
hunting-for-living-off-the-land-binaries
threat hunting · low
hunting-for-lolbins-execution-in-endpoint-logs
threat hunting · low
hunting-for-ntlm-relay-attacks
threat hunting · low
hunting-for-persistence-mechanisms-in-windows
threat hunting · low
hunting-for-persistence-via-wmi-subscriptions
threat hunting · low
hunting-for-process-injection-techniques
threat hunting · low
hunting-for-registry-persistence-mechanisms
threat hunting · low
hunting-for-registry-run-key-persistence
threat hunting · low
hunting-for-scheduled-task-persistence
threat hunting · low
hunting-for-shadow-copy-deletion
threat hunting · low
hunting-for-spearphishing-indicators
threat hunting · low
hunting-for-startup-folder-persistence
threat hunting · low
hunting-for-supply-chain-compromise
threat hunting · low
hunting-for-suspicious-scheduled-tasks
threat hunting · low
hunting-for-t1098-account-manipulation
threat hunting · low
hunting-for-unusual-network-connections
threat hunting · low
hunting-for-unusual-service-installations
threat hunting · low
hunting-for-webshell-activity
threat hunting · low
implementing-conduit-security-for-ot-remote-access
ot ics security · medium
implementing-diamond-model-analysis
threat intelligence · low
implementing-dragos-platform-for-ot-monitoring
ot ics security · medium
implementing-gdpr-data-protection-controls
compliance governance · low
implementing-ics-firewall-with-tofino
ot ics security · medium
implementing-iec-62443-security-zones
ot ics security · medium
implementing-iso-27001-information-security-management
compliance governance · low
implementing-nerc-cip-compliance-controls
ot ics security · medium
implementing-network-segmentation-for-ot
ot ics security · medium
implementing-ot-incident-response-playbook
ot ics security · medium
implementing-ot-network-traffic-analysis-with-nozomi
ot ics security · medium
implementing-patch-management-for-ot-systems
ot ics security · medium
implementing-pci-dss-compliance-controls
compliance governance · low
implementing-purdue-model-network-segmentation
ot ics security · medium
implementing-security-information-sharing-with-stix2
threat intelligence · low
implementing-stix-taxii-feed-integration
threat intelligence · low
implementing-taxii-server-with-opentaxii
threat intelligence · low
implementing-threat-intelligence-lifecycle-management
threat intelligence · low
implementing-web-application-logging-with-modsecurity
web application security · medium
investigating-ransomware-attack-artifacts
digital forensics · low
managing-intelligence-lifecycle
threat intelligence · low
mapping-mitre-attack-techniques
threat intelligence · low
monitoring-darkweb-sources
threat intelligence · low
performing-active-directory-bloodhound-analysis
red teaming · high
performing-active-directory-penetration-test
penetration testing · medium
performing-ai-driven-osint-correlation
threat intelligence · low
performing-blind-ssrf-exploitation
web application security · medium
performing-brand-monitoring-for-impersonation
threat intelligence · low
performing-clickjacking-attack-test
web application security · medium
performing-cloud-forensics-investigation
digital forensics · low
performing-cloud-storage-forensic-acquisition
digital forensics · low
performing-content-security-policy-bypass
web application security · medium
performing-credential-access-with-lazagne
red teaming · high
performing-csrf-attack-simulation
web application security · medium
performing-dark-web-monitoring-for-threats
threat intelligence · low
performing-directory-traversal-testing
web application security · medium
performing-external-network-penetration-test
penetration testing · medium
performing-file-carving-with-foremost
digital forensics · low
performing-graphql-security-assessment
web application security · medium
performing-http-parameter-pollution-attack
web application security · medium
performing-ics-asset-discovery-with-claroty
ot ics security · medium
performing-indicator-lifecycle-management
threat intelligence · low
performing-initial-access-with-evilginx3
red teaming · high
performing-iot-security-assessment
penetration testing · medium
performing-ip-reputation-analysis-with-shodan
threat intelligence · low
performing-kerberoasting-attack
red teaming · high
performing-lateral-movement-with-wmiexec
red teaming · high
performing-linux-log-forensics-investigation
digital forensics · low
performing-log-analysis-for-forensic-investigation
digital forensics · low
performing-malware-hash-enrichment-with-virustotal
threat intelligence · low
performing-malware-ioc-extraction
threat intelligence · low
performing-malware-persistence-investigation
digital forensics · low
performing-memory-forensics-with-volatility3
digital forensics · low
performing-mobile-device-forensics-with-cellebrite
digital forensics · low
performing-network-forensics-with-wireshark
digital forensics · low
performing-network-packet-capture-analysis
digital forensics · low
performing-nist-csf-maturity-assessment
compliance governance · low
performing-oil-gas-cybersecurity-assessment
ot ics security · medium
performing-open-source-intelligence-gathering
red teaming · high
performing-osint-with-spiderfoot
threat intelligence · low
performing-ot-network-security-assessment
ot ics security · medium
performing-ot-vulnerability-assessment-with-claroty
ot ics security · medium
performing-ot-vulnerability-scanning-safely
ot ics security · medium
performing-paste-site-monitoring-for-credentials
threat intelligence · low
performing-physical-intrusion-assessment
red teaming · high
performing-plc-firmware-security-analysis
ot ics security · medium
performing-power-grid-cybersecurity-assessment
ot ics security · medium
performing-privilege-escalation-assessment
penetration testing · medium
performing-privilege-escalation-on-linux
red teaming · high
performing-s7comm-protocol-security-analysis
ot ics security · medium
performing-scada-hmi-security-assessment
ot ics security · medium
performing-second-order-sql-injection
web application security · medium
performing-security-headers-audit
web application security · medium
performing-sqlite-database-forensics
digital forensics · low
performing-steganography-detection
digital forensics · low
performing-subdomain-enumeration-with-subfinder
web application security · medium
performing-thick-client-application-penetration-test
penetration testing · medium
performing-threat-emulation-with-atomic-red-team
threat intelligence · low
performing-threat-hunting-with-yara-rules
threat hunting · low
performing-threat-intelligence-sharing-with-misp
threat intelligence · low
performing-threat-landscape-assessment-for-sector
threat intelligence · low
performing-timeline-reconstruction-with-plaso
digital forensics · low
performing-vulnerability-scanning-with-nessus
penetration testing · medium
performing-web-application-firewall-bypass
web application security · medium
performing-web-application-penetration-test
penetration testing · medium
performing-web-cache-deception-attack
web application security · medium
performing-web-cache-poisoning-attack
web application security · medium
performing-windows-artifact-analysis-with-eric-zimmerman-tools
digital forensics · low
performing-wireless-network-penetration-test
penetration testing · medium
processing-stix-taxii-feeds
threat intelligence · low
profiling-threat-actor-groups
threat intelligence · low
recovering-deleted-files-with-photorec
digital forensics · low
securing-historian-server-in-ot-environment
ot ics security · medium
securing-remote-access-to-ot-environment
ot ics security · medium
testing-api-security-with-owasp-top-10
web application security · medium
testing-cors-misconfiguration
web application security · medium
testing-for-broken-access-control
web application security · medium
testing-for-business-logic-vulnerabilities
web application security · medium
testing-for-email-header-injection
web application security · medium
testing-for-host-header-injection
web application security · medium
testing-for-json-web-token-vulnerabilities
web application security · medium
testing-for-open-redirect-vulnerabilities
web application security · medium
testing-for-sensitive-data-exposure
web application security · medium
testing-for-xml-injection-vulnerabilities
web application security · medium
testing-for-xss-vulnerabilities
penetration testing · medium
testing-for-xss-vulnerabilities-with-burpsuite
web application security · medium
testing-for-xxe-injection-vulnerabilities
web application security · medium
testing-jwt-token-security
web application security · medium
tracking-threat-actor-infrastructure
threat intelligence · low
© 2026 Casky.AI, Inc. · AI Security Investigation