CVE-2026-18727

A flaw was found in open-iscsi's iscsiuio component. This vulnerability involves an integer underflow and out-of-bounds read during Dynamic Host Configuration Protocol for IPv6 (DHCPv6) packet parsing. Specifically, crafted DHCPv6 Advertise traffic with a short User Datagram Protocol (UDP) length can cause the DHCPv6 payload length to underflow. An unauthenticated attacker on an adjacent network segment can exploit this by sending specially crafted IPv6 UDP traffic while the client is in an active DHCPv6 exchange, leading to a denial of service due to a process crash or service disruption.

• CWE-191

• https://access.redhat.com/security/cve/CVE-2026-18727Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2462956Issue Tracking, Vendor Advisory

Published

Aug 12, 2026

Last Modified

Aug 25, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-18719A vulnerability was detected in cemtan sar2html 4.0.0. This …6.3
• CVE-2026-18720A flaw has been found in kalcaddle kodbox 1.67 Build 02. Thi…5.5
• CVE-2026-18721A vulnerability has been found in kalcaddle kodbox 1.67 Buil…4.3
• CVE-2026-18722A vulnerability was found in diaowen DWSurvey up to 6.14.0. …6.3
• CVE-2026-18723A vulnerability was determined in diaowen DWSurvey up to 6.1…6.3
• CVE-2026-18726A flaw was found in open-iscsi. This vulnerability allows a …6.5
• CVE-2026-18728A flaw was found in open-iscsi. An integer underflow vulnera…6.5
• CVE-2026-18729IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote a…8.8
• CVE-2026-18730A server-side request forgery (SSRF) vulnerability was ident…7.4
• CVE-2026-18733A prompt injection vulnerability in the shell tool in Amazon…8.8
• CVE-2026-18736Shlink contains a server-side request forgery vulnerability …5
• CVE-2026-18737Shlink contains a blind SQL injection vulnerability that all…6.5