External risk intelligence

Incus Argument Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-62867

Incus is a system container and virtual machine manager typically deployed in internal, administrative, or host-level environments. While it manages infrastructure, it is not designed to be public-facing and is usually restricted to internal management networks or privileged local users, making direct exposure to the public internet uncommon.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability involves a system container and virtual machine manager that could allow a user with project-level access to inject commands, potentially leading to unauthorized actions on the system. The primary concern is confirming if this specific type of system management software is in use within the organization and, if so, assessing the extent of potential exposure.

Injects commands, affecting system management tools.
Matters for infrastructure control and unauthorized access.
Confirm relevance and exposure within our environment.

Attack Path

How an attacker could exploit the issue

An attacker with project-level access could exploit this vulnerability by providing specially crafted input when configuring storage volumes. This input would be improperly validated, leading to the injection of arbitrary commands into a filesystem creation process that runs with root privileges. The vulnerability can allow an attacker to execute arbitrary code with elevated permissions.

Requires project-level user access.
Triggered by creating storage volumes.
Allows root command execution.

Live Threat

Current exploitation, exposure, and threat context

Incus, a manager for system containers and virtual machines, has a vulnerability where improperly validated storage volume configurations could allow a project-scoped user to inject arbitrary commands into a filesystem creation process executed with root privileges. This could lead to unauthorized modification or execution of code on the host system when specific conditions are met within the Incus environment.

Arbitrary command execution on host.
Malicious arguments injected into commands.
Host system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Incus, a system container and virtual machine manager, could allow a project-scoped user to inject arbitrary arguments into a command executed as root. The first practical step is to identify all Incus deployments, confirm their reachability and business criticality, and then ascertain the accountable owner for remediation, planning the necessary actions based on the assessed risk.

Identify Incus deployment and ownership.
Verify network reachability and business impact.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Incus and what is it used for?

Incus is an open-source software platform designed to manage system containers and virtual machines. It provides a unified interface for infrastructure teams to create, deploy, and oversee virtualized environments on a host machine, effectively acting as an engine for resource isolation and application hosting.

What does CVE-2026-62867 mean by argument injection?

This vulnerability, classified as CWE-88 (Improper Neutralization of Argument Delimiters in a Command), occurs when software fails to properly sanitize user-supplied input. In this case, malicious characters in storage volume configuration settings allow an attacker to append unintended, extra commands to a backend filesystem creation process that executes with root permissions.

How is the Incus vulnerability triggered?

An attacker triggers this by submitting specifically crafted input into the storage volume configuration settings. It is important to note that this is not triggered by standard operations or casual use; the attacker must already possess project-scoped access to the platform to manipulate these configuration fields.

Is my Incus deployment at risk?

Halo Surface Signal indicates that Incus is typically deployed within internal, administrative networks rather than being public-facing. Therefore, while the vulnerability is serious, the likelihood of direct external access is lower. You should prioritize internal systems where project-level access is granted to untrusted or less-privileged users.

What are the first steps to address this CVE?

Begin by inventorying your environment to locate all active Incus installations and identifying the teams responsible for their management. Once identified, verify their current version; if you are running any version prior to 7.3.0, you should coordinate with your infrastructure team to prioritize and schedule the update to the patched version.

References

github.com/lxc/incus/security/advisories/GHSA-q7xw-r4w2-2wcm

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.