CVE-2026-18726

A flaw was found in open-iscsi. This vulnerability allows a remote attacker on the same local network segment to cause a Denial of Service (DoS) in the iscsiuio daemon. By sending a specially crafted Internet Control Message Protocol version 6 (ICMPv6) Router Advertisement with a zero-length option, the attacker can trigger an infinite loop. This leads to sustained CPU usage, rendering the daemon unresponsive and impacting system availability. A secondary risk of out-of-bounds reads exists with a short IPv6 payload, though no memory corruption or data exposure has been confirmed.

• CWE-835

• https://access.redhat.com/security/cve/CVE-2026-18726Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2462331Issue Tracking

Published

Aug 12, 2026

Last Modified

Aug 25, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-18718Ghidra contains an arbitrary code execution vulnerability in…7
• CVE-2026-18719A vulnerability was detected in cemtan sar2html 4.0.0. This …6.3
• CVE-2026-18720A flaw has been found in kalcaddle kodbox 1.67 Build 02. Thi…5.5
• CVE-2026-18721A vulnerability has been found in kalcaddle kodbox 1.67 Buil…4.3
• CVE-2026-18722A vulnerability was found in diaowen DWSurvey up to 6.14.0. …6.3
• CVE-2026-18723A vulnerability was determined in diaowen DWSurvey up to 6.1…6.3
• CVE-2026-18727A flaw was found in open-iscsi's iscsiuio component. This vu…6.5
• CVE-2026-18728A flaw was found in open-iscsi. An integer underflow vulnera…6.5
• CVE-2026-18729IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote a…8.8
• CVE-2026-18730A server-side request forgery (SSRF) vulnerability was ident…7.4
• CVE-2026-18733A prompt injection vulnerability in the shell tool in Amazon…8.8
• CVE-2026-18736Shlink contains a server-side request forgery vulnerability …5