External risk intelligence

Incus Arbitrary File Write via Malicious Migration Symlinks

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-115377

Incus is a system container and virtual machine manager typically deployed in internal infrastructure or controlled environments for managing workloads. While it supports remote operations and migrations, these services are generally restricted to administrative networks or internal orchestration rather than being exposed directly to the public internet.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability in Incus could allow attackers to write arbitrary files to your systems by exploiting a symlink issue during data transfer, potentially leading to full host compromise. The primary concern is to confirm if this technology is used within your environment and assess any potential exposure.

Attackers can write unauthorized files to systems.
Confirms relevance and exposure within your environment.
Assess Incus usage; address if applicable.

Attack Path

How an attacker could exploit the issue

An attacker with low-privileged access to Incus can exploit this vulnerability by crafting a malicious migration stream. This stream can contain a symbolic link that, when processed during the migration of volumes, redirects file writes to critical host system locations. Successful manipulation allows the attacker to write files as the root user, potentially leading to full compromise of the host system.

Requires low-privileged access.
Triggers when processing migration streams.
Enables arbitrary file write as root.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow a malicious migration source, when conditions are met, to write arbitrary files to the host system with root privileges. This could occur when transferring volumes between Incus instances, if an attacker can plant a symbolic link within the transferred data that targets the host's root filesystem.

Host files could be overwritten.
Symlinks in transferred volumes.
Full host compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability likely impacts infrastructure or platform teams responsible for managing Incus, as it allows for host file writes via malicious migration streams. The immediate first step should be to identify all Incus deployments, confirm their network exposure and criticality, and then locate the accountable owner to plan remediation based on the identified risk.

Infrastructure or platform teams own the issue.
Verify Incus deployment reachability and criticality.
Plan remediation with vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Incus and how is it used?

Incus is an open-source system container and virtual machine manager. Developers and system administrators use it to create, run, and manage isolated Linux workloads. It allows users to move these environments between different servers—a process called migration—to balance resources or perform system maintenance.

What is the weakness class for CVE-2026-115377?

This vulnerability is classified as Improper Link Resolution Before File Access, also known as CWE-59. In the context of this CVE, it means the software fails to properly check symbolic links during volume migrations. An attacker can use this oversight to trick the system into writing files to sensitive locations on the host machine instead of the intended container directory.

How can an attacker trigger this vulnerability?

The vulnerability is triggered during the migration process when Incus processes a malicious data stream. An attacker must initiate a migration from a compromised or malicious source containing a crafted symbolic link. Simply using Incus for standard operations where you control both the source and destination does not trigger this issue; it specifically requires the ingestion of untrusted or maliciously crafted migration data.

Is my environment at risk from CVE-2026-115377?

According to Halo Surface Signal, this vulnerability is categorized as unlikely to be exposed to the public internet because Incus is typically managed within internal infrastructure or administrative networks. You should be most concerned if your Incus instances are accessible from untrusted networks or if you frequently perform migrations from sources you do not fully control.

How should I respond to this Incus vulnerability?

Start by identifying all Incus installations in your environment to understand your footprint. Once mapped, confirm whether these instances allow migrations from untrusted sources. Coordinate with your infrastructure team to prioritize updating to the patched versions provided by the project, as this is the only way to ensure the software properly handles symlinks during data transfers.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.