Strix
26.1K

CVE-2026-15422

CRITICALCVSS 9.1/10EPSS 0.51%

Last modified

CVE-2026-15422 is a critical-severity vulnerability rated 9.1/10 on the CVSS scale. The illumos SCTP inbound path performs association lookup for INIT ACK chunks without adequately validating the address parameters carried in the chunk. Since this lookup runs during packet classification (i.e. EPSS estimates a 0.51% chance of exploitation in the next 30 days.

Description

The illumos SCTP inbound path performs association lookup for INIT ACK chunks without adequately validating the address parameters carried in the chunk. Since this lookup runs during packet classification (i.e. before SCTP integrity checks or IPsec policy are applied) a remote, unauthenticated attacker can send a crafted SCTP INIT ACK packet with malformed address parameters to cause an out-of-bounds access and kernel heap corruption, which may lead to remote code execution. The flaw has existed since 2010 (illumos-gate commit a5407c02), and affects any illumos distribution prior to illumos-gate commit 53a3efde.

Metrics

CVSS 4.0
9.1/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:C/RE:H/U:Red

EPSS Probability
0.51%

40.0th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
illumosillumos-gate>= a5407c02d5ed61b29481b9b71f1307d7ebec9e5c, < 53a3efdeff8e6745bbfb69c5360f94962fb79e75
OmniOSOmniOS>= r151058, < r151058j; >= r151056, < r151056aj; >= r151054, < r151054bj; >= any, < r151054
Triton Data CenterSmartOS>= any, < 202060709

References

Timeline

Published
Last Modified
Status
Deferred

Frequently Asked Questions

What is CVE-2026-15422?
The illumos SCTP inbound path performs association lookup for INIT ACK chunks without adequately validating the address parameters carried in the chunk. Since this lookup runs during packet classification (i.e. before SCTP integrity checks or IPsec policy are applied) a remote, unauthenticated attacker can send a crafted SCTP INIT ACK packet with malformed address parameters to cause an out-of-bounds access and kernel heap corruption, which may lead to remote code execution. The flaw has existed since 2010 (illumos-gate commit a5407c02), and affects any illumos distribution prior to illumos-gate commit 53a3efde.
How severe is CVE-2026-15422?
CVE-2026-15422 has a CVSS score of 9.1/10 (CRITICAL severity). The EPSS model estimates a 0.51% probability of exploitation in the next 30 days.
How do I fix CVE-2026-15422?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-15422?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST