CVE-2013-6398: The virtual router in Apache CloudStack before 4.2.1 does not preserve the source restrictions in firewall...

Security readout for executives and security teams

Apache CloudStack before 4.2.1 could lose firewall source restrictions on a virtual router after that router restarted. A rule meant to allow only trusted source IP ranges might become broader than intended, allowing remote access that administrators expected to block. Exposure is most likely in organizations still running Apache CloudStack versions before 4.2.1, especially environments relying on virtual router firewall rules with source-based restrictions for public services or tenant networks. Prioritize remediation where CloudStack protects internet-facing or tenant-sensitive services. This is a firewall bypass condition, but urgency depends on whether affected versions remain deployed and whether source restrictions are business-critical. Mitigation focus: Identify any Apache CloudStack deployments older than 4.2.1.; Upgrade affected CloudStack environments to 4.2.1 or later vendor-supported fixes.; Review Apache and Citrix guidance for environment-specific remediation details..

Prepared

Jun 14, 2026, 14:50 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.