Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A vulnerability relating to incorrect access control in OpenNebula by OpenNebula Systems, affecting all versions prior to 7.4. This vulnerability could allow an authenticated user with basic permissions to execute commands on virtual machines belonging to other users via the `one.vm.exec` function, without proper verification of access permissions. To exploit the vulnerability, it is only necessary to know the virtual machine’s identifier and for qemu-agent to be enabled on that machine. Exploitation could allow commands to be executed and compromise the confidentiality, integrity and availability of the affected virtual machines.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
⚠️#INCIBEaviso | Falta de autorización en OpenNebula de #OpenNebula Systems #CVE CVE-2026-84165 https://www.incibe.es/incibe-cert/alerta-temprana/avisos/falta-de-autorizacion-en-opennebula-de-opennebula-systems #AvisosDeSeguridad #TI #CNA #0day
Post summary
INCIBE announces a security alert for an authorization flaw in OpenNebula (CVE-2026-84165) without detailing evidence of exploitation or mitigations.