Is CVE-2026-44943 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44943 being exploited in the wild.

How severe is CVE-2026-44943?

Informational severity, with a CVSS score of 6.9, published 29 July 2026.

Which products and versions are affected?

Open-iSCSI Project Open-Iscsi through commit 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.

Is there a fix for CVE-2026-44943?

A patch was published on 2026-07-29: Fix committed to open-iscsi repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44943 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-44943?

Check whether you run Open-iSCSI Project Open-Iscsi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44943: open-iscsi path traversal in discovery IQN handling

CVE-2026-44943 · Severity: info · CVSS 6.9 · Published 2026-07-29

open-iscsi is a software suite used to connect Linux systems to network-based storage. A vulnerability in how it handles storage target names allows a network attacker to create unauthorized files on the system with administrative privileges. This could lead to system instability or unauthorized modification of system records.

Technologies: Open-iSCSI Project Open-Iscsi. Vendors: Open-iSCSI Project.

Quick answers

Is CVE-2026-44943 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44943 being exploited in the wild.
How severe is CVE-2026-44943?: Informational severity, with a CVSS score of 6.9, published 29 July 2026.
Which products and versions are affected?: Open-iSCSI Project Open-Iscsi through commit 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.
Is there a fix for CVE-2026-44943?: A patch was published on 2026-07-29: Fix committed to open-iscsi repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44943 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-44943?: Check whether you run Open-iSCSI Project Open-Iscsi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability (CWE-22) exists in open-iscsi's discovery handling of iSCSI Qualified Names (IQNs). The software uses received target names as directory names within the database (typically /var/lib/iscsi) without sufficient validation of prohibited ASCII characters defined in RFC 3722. A remote attacker, potentially via a Man-in-the-Middle (MITM) position or a malicious discovery server, can provide a crafted IQN containing sequences like '../../..' to create root-owned files outside the database directory. This issue is addressed in commit 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e by enforcing stricter IQN character validation.

Affected products

open-iscsi open-iscsi through commit 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e

Timeline

2026-07-29: advisory: NVD publication date
2026-07-29: patched: Fix committed to open-iscsi repository

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.