SEPTEMBER 17, 2026
Live Feed
Back to database
Case File

CVE-2026-18265

CRITICAL · CVSS 9.8 EPSS 0.69% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-08-20 · Last synced 2026-09-17

CyberRota Analysis

AI-Generated

OSNEXUS QuantaStor is vulnerable to a critical remote code execution flaw that allows unauthenticated attackers to execute arbitrary code with root privileges. This vulnerability arises from improper configuration in Kapacitor, enabling exploitation without any authentication. Organizations using QuantaStor should prioritize immediate remediation efforts to mitigate potential exploitation risks.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Detected Signals
exploit remote code execution code execution

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-18265
Severity
CRITICAL
CVSS
9.8
EPSS
0.69%

Original NVD Description

OSNEXUS QuantaStor Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OSNEXUS QuantaStor. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of Kapacitor. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-30036.