SoftIron HyperCloud vulnerabilities

Latest SoftIron HyperCloud CVEs

Newest publication first

1. CVE-2026-116755 SoftIron HyperCloud: OS Command Injection in Orchestrator via Virtual Machine Template Fields

   Published 2026-10-31

   High·CVSS 7.4

   Improper Neutralization of Special Elements used in a Command ('Command Injection') in the Orchestrator component of SoftIron HyperCloud allows an authenticated user with access to the management plane to execute arbitrary operating system commands on hypervisor hosts as the priv...

2. CVE-2026-1842 HyperCloud Improper Refresh Token Validation and Access Token Invalidation Allows Long-Term Unauthorized Access

   Published 2026-02-20

   Medium·CVSS 6.2

   HyperCloud versions 2.3.5 through 2.6.8 improperly allowed refresh tokens to be used directly for resource access and failed to invalidate previously issued access tokens when a refresh token was used. Because refresh tokens have a significantly longer lifetime (default one year)...

3. CVE-2025-10650 Improper SSH Key Handling in Internal Debug Builds May Grant Cluster-Level Access to Non-Administrative Users

   Published 2025-09-18

   Low·CVSS 1.8

   SoftIron HyperCloud 2.5.0 through 2.6.3 may incorrectly add user SSH keys to the administrator-level authorized keys under certain conditions, allowing unauthorized privilege escalation to admin via SSH. Affects non-production debug and internal development builds created between...

4. CVE-2023-45085 When compute hosts are disabled and reenabled, they immediately transition to "ON", not "INIT"

   Published 2023-12-05

   Low·CVSS 3.2

   An issue exists in SoftIron HyperCloud where compute nodes may come online immediately without following the correct initialization process. In this instance, workloads may be scheduled on these nodes and deploy to a failed or erroneous state, which impacts the availability of th...

5. CVE-2023-45084 Media caddy removal and reinsertion without reboot may cause data loss

   Published 2023-12-05

   High·CVSS 7.0

   An issue exists in SoftIron HyperCloud where drive caddy removal and reinsertion without a reboot may erroneously cause the system to recognize the caddy as new media and wipe all data on the drives due to a missing synchronization flaw, which impacts data availability and integr...

6. CVE-2023-45083 HyperCloud: "admin" and "serveradmin" users can be deleted

   Published 2023-12-05

   Medium·CVSS 4.2

   An Improper Privilege Management vulnerability exists in HyperCloud that will impact the ability for a user to authenticate against the management plane. An authenticated admin-level user may be able to delete the "admin" or "serveradmin" users, which prevents authentication from...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.