🟠 High | Source: Microsoft Security Response Center
CVE-2026-55995 is a double-free memory corruption vulnerability in the iSNS (Internet Storage Name Service) attribute decoder within open-iscsi, an open-source iSCSI initiator used to connect systems to storage over IP networks. Double-free flaws occur when a programme attempts to free the same memory region twice, which can lead to arbitrary code execution or a system crash. This is particularly relevant in cloud and virtualised environments where iSCSI-based block storage is commonly used.
Security Architect’s Take: Audit your Azure-hosted workloads and VM images for any use of open-iscsi, prioritising internet-facing or shared storage nodes, and apply vendor patches or mitigations as soon as they become available. In the interim, restrict network access to iSNS services to trusted hosts only, using NSGs or firewall rules to reduce the attack surface.
Original advisory: CVE-2026-55995 Double-free in the iSNS attribute decoder in open-iscsi