Is CVE-2026-15422 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15422 being exploited in the wild.

How severe is CVE-2026-15422?

Informational severity, with a CVSS score of 9.1, published 16 July 2026.

Which products and versions are affected?

Illumos-Gate a5407c02 to 53a3efde; OmniOS Prior to r151058j, r151056aj, or r151054bj.

Is there a fix for CVE-2026-15422?

A patch was published on 2026-07-08: Fix committed to illumos-gate repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-15422 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-15422?

Check whether you run Illumos-Gate or OmniOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15422: illumos SCTP heap corruption in INIT ACK processing

CVE-2026-15422 · Severity: info · CVSS 9.1 · Published 2026-07-16

A vulnerability exists in the SCTP networking component of illumos-based operating systems, which are used for server and cloud infrastructure. An attacker can send a specially crafted network packet to crash the system or potentially take full control of the server. This occurs before standard security checks are applied, meaning even systems with firewalls or encryption enabled may be vulnerable.

Technologies: OmniOS. Vendors: Illumos, OmniOS.

Quick answers

Is CVE-2026-15422 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15422 being exploited in the wild.
How severe is CVE-2026-15422?: Informational severity, with a CVSS score of 9.1, published 16 July 2026.
Which products and versions are affected?: Illumos-Gate a5407c02 to 53a3efde; OmniOS Prior to r151058j, r151056aj, or r151054bj.
Is there a fix for CVE-2026-15422?: A patch was published on 2026-07-08: Fix committed to illumos-gate repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-15422 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-15422?: Check whether you run Illumos-Gate or OmniOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based buffer overflow (CWE-122) and out-of-bounds write (CWE-787) exist in the illumos SCTP implementation, specifically within the `sctp_lookup_by_faddrs` function in `sctp_hash.c`. The flaw occurs because the inbound path performs association lookups for INIT ACK chunks without validating address parameters during the packet classification phase. Because this lookup happens before SCTP integrity checks or IPsec policies are enforced, a remote unauthenticated attacker can trigger kernel heap corruption. This can result in a kernel panic (denial of service) or remote code execution. The vulnerability has been patched in illumos-gate commit 53a3efde and corresponding downstream distributions.

Affected products

illumos illumos-gate a5407c02 to 53a3efde
OmniOS OmniOS Prior to r151058j, r151056aj, or r151054bj
Triton Data Center SmartOS Prior to 20260709

Timeline

2010: other: Vulnerability introduced in commit a5407c02
2026-07-08: patched: Fix committed to illumos-gate repository
2026-07-16: advisory: CVE-2026-15422 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.