CVE-2026-48769 – Incus

Zero Day – Immediate Deployment

Incus fixes a broad set of security flaws involving unsafe file handling, symlink attacks, argument injection, missing authorization checks, and project-restriction bypasses. The issues can expose sensitive instance or volume data, allow arbitrary host file access or writes, bypass container restrictions, and in several cases lead to arbitrary command execution or host compromise. Fixes are included across Incus 7.1.0, 7.2.0, and 7.3.0.

CVE-2026-48749 has a CVSS score of 9.9, Critical severity. CVE-2026-48750 has a CVSS score of 9.9, Critical severity. CVE-2026-48751 has a CVSS score of 9.9, Critical severity. CVE-2026-48752 has a CVSS score of 9.9, Critical severity. CVE-2026-48753 has a CVSS score of 9.9, Critical severity. CVE-2026-48755 has a CVSS score of 9.9, Critical severity. CVE-2026-48769 has a CVSS score of 9.9, Critical severity. CVE-2026-62867 has a CVSS score of 9.9, Critical severity. CVE-2026-62940 has a CVSS score of 9.9, Critical severity. CVE-2026-62941 has a CVSS score of 9.9, Critical severity. CVE-2026-63125 has a CVSS score of 9.9, Critical severity. CVE-2026-63343 has a CVSS score of 9.9, Critical severity. CVE-2026-55621 has a CVSS score of 7.7, High severity. CVE-2026-55622 has a CVSS score of 7.7, High severity.

Public proof-of-concept exploitation is confirmed for CVE-2026-48749, CVE-2026-48751, CVE-2026-48753, CVE-2026-48769, CVE-2026-62941, CVE-2026-63125, and CVE-2026-55622.

Patch this CVE on all your endpoints in under 5 minutes. First 200 endpoints are free forever, scale as needed.