CVE-2026-18728

A flaw was found in open-iscsi. An integer underflow vulnerability in the `iscsiuio` component, specifically during IPv4 Dynamic Host Configuration Protocol (DHCP) parsing, allows a remote attacker on the same local network segment to cause a denial of service. By sending a specially crafted IPv4/UDP DHCP reply, the attacker can trigger an out-of-bounds read, leading to the `iscsiuio` process crashing. This issue affects systems where `iscsiuio` is actively handling IPv4 DHCP traffic.

• CWE-191

• https://access.redhat.com/security/cve/CVE-2026-18728Vendor Advisory, Mitigation
• https://bugzilla.redhat.com/show_bug.cgi?id=2463029Issue Tracking, Vendor Advisory

Published

Aug 13, 2026

Last Modified

Aug 25, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-18720A flaw has been found in kalcaddle kodbox 1.67 Build 02. Thi…5.5
• CVE-2026-18721A vulnerability has been found in kalcaddle kodbox 1.67 Buil…4.3
• CVE-2026-18722A vulnerability was found in diaowen DWSurvey up to 6.14.0. …6.3
• CVE-2026-18723A vulnerability was determined in diaowen DWSurvey up to 6.1…6.3
• CVE-2026-18726A flaw was found in open-iscsi. This vulnerability allows a …6.5
• CVE-2026-18727A flaw was found in open-iscsi's iscsiuio component. This vu…6.5
• CVE-2026-18729IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote a…8.8
• CVE-2026-18730A server-side request forgery (SSRF) vulnerability was ident…7.4
• CVE-2026-18733A prompt injection vulnerability in the shell tool in Amazon…8.8
• CVE-2026-18736Shlink contains a server-side request forgery vulnerability …5
• CVE-2026-18737Shlink contains a blind SQL injection vulnerability that all…6.5
• CVE-2026-18738Shlink versions 5.0.0 through 5.1.5 contain a CSV formula in…4.7