CVE-2026-115486 Red Hat CVE debrief

Who should care

Network administrators and security teams responsible for open-iscsi deployments should assess exposure and prioritize remediation due to potential traffic redirection risks. They should verify open-iscsi versions and configurations, review compensating controls for exposed systems, and update incident response plans to address potential ARP table poisoning.

Why it matters

CVE-2026-115486 allows an attacker to redirect network traffic by poisoning the ARP table, posing a significant risk to network administrators and security teams responsible for open-iscsi deployments. The vulnerability requires verification of exposure and prioritization of remediation.

• Network traffic redirection and potential for man-in-the-middle attacks
• ARP table poisoning and potential for network instability
• Verification of open-iscsi versions and configurations is necessary

Technical summary

The iscsiuio component of open-iscsi has a flaw in its IPv6 Neighbor Discovery handler, allowing an attacker to access link-layer address options at a fixed offset without verification. The ARP table is updated unconditionally with attacker-controlled addresses from packet headers, enabling an attacker on the same network segment to send a minimal Neighbor Advertisement and poison the ARP table. This issue requires verification of exposure and prioritization of remediation due to potential traffic redirection risks.

Defensive priority

Network administrators should verify exposure and prioritize remediation due to potential traffic redirection risks.

Recommended defensive actions

• Verify network exposure and check for open-iscsi updates
• Implement network segmentation and monitoring to detect suspicious traffic
• Review and update incident response plans to address potential ARP table poisoning
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in open-iscsi's iscsiuio component. Additional verification is needed to confirm affected versions and remediation. The vulnerability allows an attacker to redirect network traffic by poisoning the ARP table, posing a significant risk to network administrators and security teams responsible for open-iscsi deployments. The CVE Program record and NVD detail page offer source-provided CVE metadata and vulnerability assessment. However, further review of open-iscsi versions

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.