high 8.5

CVE-2026-44944 json

iscsiuio control-socket authentication bypass in open-iscsi

published 2026-07-29 3mo ago modified 2026-07-30 3mo ago also EUVD-2026-50312

cvss: 8.5; version 4.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.1%; EPSS 0.1% chance of exploitation in 30 days, percentile 0%
public exploits: 0; none known

An Incorrect Authorization vulnerability in open-iscsi allows unprivilidged local users to use the isscsiuio control socket.

This issue affects open-iscsi: from ? through 668ca1df9c9a1e9bdd5c999ae1d67c9c8909237e.

Patch / fix

distros 7 links 1

debian red hat suse opensuse almalinux rocky linux azure linux

open-iscsi Debian 12 2.1.8-1+deb12u1
open-iscsi Debian 14 2.1.12-1

debian advisories DEBIAN-CVE-2026-44944

iscsi-initiator-utils RHEL 10.2 6.2.1.11-1.git4b3e853.el10_2.2
python3-iscsi-initiator-utils RHEL 10.2 6.2.1.11-1.git4b3e853.el10_2.2
iscsi-initiator-utils-iscsiuio RHEL 10.2 6.2.1.11-1.git4b3e853.el10_2.2
iscsi-initiator-utils RHEL 9 6.2.1.11-1.git4b3e853.el9_8.2
python3-iscsi-initiator-utils RHEL 9 6.2.1.11-1.git4b3e853.el9_8.2
iscsi-initiator-utils-iscsiuio RHEL 9 6.2.1.11-1.git4b3e853.el9_8.2
iscsi-initiator-utils RHEL 9.2 E4S 6.2.1.4-3.git2a8f9d8.el9_2.2
python3-iscsi-initiator-utils RHEL 9.2 E4S 6.2.1.4-3.git2a8f9d8.el9_2.2

red hat advisories RHSA-2026:62029 RHSA-2026:60427 RHSA-2026:60428 RHSA-2026:53845 RHSA-2026:53844

open-iscsi SLE Module for Basesystem 15 SP7 2.1.12-150700.57.6.1
open-iscsi SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 2.1.12-160000.4.1

suse advisories SUSE-SU-2026:3647-1 SUSE-SU-2026:23157-1 SUSE-SU-2026:23223-1 SUSE-SU-2026:23235-1

open-iscsi openSUSE Leap 16.0 2.1.12-160000.4.1

opensuse advisories openSUSE-SU-2026:21580-1

iscsi-initiator-utils AlmaLinux 9 6.2.1.11-1.git4b3e853.el9_8.2
python3-iscsi-initiator-utils AlmaLinux 9 6.2.1.11-1.git4b3e853.el9_8.2
iscsi-initiator-utils-iscsiuio AlmaLinux 9 6.2.1.11-1.git4b3e853.el9_8.2
iscsi-initiator-utils AlmaLinux 10 6.2.1.11-1.git4b3e853.el10_2.2
python3-iscsi-initiator-utils AlmaLinux 10 6.2.1.11-1.git4b3e853.el10_2.2
iscsi-initiator-utils-iscsiuio AlmaLinux 10 6.2.1.11-1.git4b3e853.el10_2.2

almalinux advisories ALSA-2026:53844 ALSA-2026:53845

iscsi-initiator-utils Rocky Linux 10 6.2.1.11-1.git4b3e853.el10_2.2
iscsi-initiator-utils Rocky Linux 9 6.2.1.11-1.git4b3e853.el9_8.2

rocky linux advisories RLSA-2026:53845 RLSA-2026:53844

iscsi-initiator-utils Azure Linux 3.0 2.1.12-1

azure linux advisories AZL-94431

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

github.com/open-iscsi/open-iscsi@668ca1d commit

Is CVE-2026-44944 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-44944 updated 2026-09-01 cvss 7.8

open-iscsi: open-iscsi: Authentication bypass in iscsiuio control socket

Red Hat Enterprise Linux AppStream (v. 9) python3-iscsi-initiator-utils 6.2.1.11-1.git4b3e853.el9_8.2
fixed: vendor fix RHSA-2026:53844
Red Hat Enterprise Linux AppStream (v. 10) python3-iscsi-initiator-utils 6.2.1.11-1.git4b3e853.el10_2.2
fixed: vendor fix RHSA-2026:53845
Red Hat Enterprise Linux AppStream E4S (v.9.2) python3-iscsi-initiator-utils 6.2.1.4-3.git2a8f9d8.el9_2.2
fixed: vendor fix RHSA-2026:62029
Red Hat Enterprise Linux AppStream E4S (v.9.4) python3-iscsi-initiator-utils 6.2.1.9-1.gita65a472.el9_4.2
fixed: vendor fix RHSA-2026:60427
Red Hat Enterprise Linux AppStream EUS (v.9.6) python3-iscsi-initiator-utils 6.2.1.9-1.gita65a472.el9_6.3
fixed: vendor fix RHSA-2026:60428
Red Hat Enterprise Linux BaseOS (v. 9) iscsi-initiator-utils 6.2.1.11-1.git4b3e853.el9_8.2, iscsi-initiator-utils-iscsiuio 6.2.1.11-1.git4b3e853.el9_8.2
fixed: vendor fix RHSA-2026:53844
Red Hat Enterprise Linux BaseOS (v. 10) iscsi-initiator-utils 6.2.1.11-1.git4b3e853.el10_2.2, iscsi-initiator-utils-iscsiuio 6.2.1.11-1.git4b3e853.el10_2.2
fixed: vendor fix RHSA-2026:53845
Red Hat Enterprise Linux BaseOS E4S (v.9.2) iscsi-initiator-utils 6.2.1.4-3.git2a8f9d8.el9_2.2, iscsi-initiator-utils-iscsiuio 6.2.1.4-3.git2a8f9d8.el9_2.2
fixed: vendor fix RHSA-2026:62029

show 2 more

Red Hat Enterprise Linux BaseOS E4S (v.9.4) iscsi-initiator-utils 6.2.1.9-1.gita65a472.el9_4.2, iscsi-initiator-utils-iscsiuio 6.2.1.9-1.gita65a472.el9_4.2
fixed: vendor fix RHSA-2026:60427
Red Hat Enterprise Linux BaseOS EUS (v.9.6) iscsi-initiator-utils 6.2.1.9-1.gita65a472.el9_6.3, iscsi-initiator-utils-iscsiuio 6.2.1.9-1.gita65a472.el9_6.3
fixed: vendor fix RHSA-2026:60428

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 3mo ago (2026-07-29)

Exploit prediction

0.09% chance of exploitation in the next 30 days, higher than 0% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
CNA	4.0	8.5	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA	4.0	8.5	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

open-iscsi open-iscsi

Classification

Weakness

CWE-863 Incorrect Authorization

References

Sources

CVE List CVE-2026-44944
NVD CVE-2026-44944

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

json all entries feed