# CVE-2026-115486: open-iscsi IPv6 Neighbor Discovery handler buffer access vulnerability

Source: https://junglewise.ai/threats/cve-2026-115486-a-flaw-was-found-in-the-iscsiuio-component-of-open-iscsi-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-23. Updated: 2026-10-23  
License: CC BY 4.0 with a link back

CVE-2026-115486 · Severity: high · CVSS 7.1 · Published 2026-10-23

A vulnerability in open-iscsi's IPv6 Neighbor Discovery handler allows an attacker on the same network segment to send a malicious Neighbor Advertisement packet that poisons the ARP table and redirects network traffic. This can lead to man-in-the-middle attacks, data interception, or network outages for systems using iSCSI network storage.

Vendors: [Open-Iscsi](https://junglewise.ai/threats/vendors/open-iscsi).

## Quick answers

**Is CVE-2026-115486 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-115486 being exploited in the wild.

**How severe is CVE-2026-115486?** High severity, with a CVSS score of 7.1, published 23 October 2026.

**Which products and versions are affected?** Open-Iscsi <UNKNOWN>.

**Is there a fix for CVE-2026-115486?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-115486 attacked?** It is attacked from the adjacent network.

**Am I affected by CVE-2026-115486?** Check whether you run Open-Iscsi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The iscsiuio component accesses link-layer address options at a fixed offset without validating that the packet contains those options, and unconditionally updates the ARP table with attacker-controlled addresses from packet headers. An adjacent network attacker can exploit this by sending a minimal Neighbor Advertisement packet to poison ARP entries and redirect traffic. This is a CWE-119 buffer access issue combined with improper input validation.

## Affected products

- open-iscsi open-iscsi <UNKNOWN>

## Timeline

- 2026-10-23: disclosed

## References

- [https://access.redhat.com/downloads/content/package-browser/](https://access.redhat.com/downloads/content/package-browser/)
- [https://access.redhat.com/security/cve/CVE-2026-115486](https://access.redhat.com/security/cve/CVE-2026-115486)

## Related threats

- [open-iscsi iscsiuio DHCPv4 option buffer overflow](https://junglewise.ai/threats/cve-2026-115484-a-flaw-was-found-in-the-iscsiuio-component-of-open-iscsi-the)