External risk intelligence

Incus Root Code Execution via Crafted Image Backup

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-63125

Incus is a system container and virtual machine manager typically deployed in internal infrastructure or private cloud environments. While network-accessible, it is generally managed by authorized users within an internal network rather than being exposed directly to the public internet.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability exists in Incus, a system container and virtual machine manager, that could allow a user with limited privileges to execute arbitrary code as root on the host system. This could occur if a specially crafted image is used, causing the system to follow a symbolic link during the backup process. The issue has been addressed in version 7.3.0.

Limited users could run unauthorized code.
Matters for system integrity and control.
Confirm if Incus is in use and relevant.

Attack Path

How an attacker could exploit the issue

An unprivileged user within Incus, a system container and virtual machine manager, can craft a special image containing a symbolic link. This link, when used in the backup process by the root daemon, allows arbitrary code execution on the host system, potentially granting the attacker root privileges.

Requires unprivileged user access.
Triggered by a crafted image backup.
Allows arbitrary code execution as root.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an unprivileged user with specific permissions within Incus could execute arbitrary code as root on the host system. This is possible when a crafted image is used to create a symbolic link to a sensitive host file, which the Incus daemon then follows during the backup process.

Host system files could be exposed.
Backup process may follow symlinks.
Arbitrary code execution as root.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts Incus, a system container and virtual machine manager. The immediate priority is for infrastructure or platform teams to identify all Incus deployments, assess their exposure, and determine business criticality to prioritize remediation efforts with the accountable owner.

Identify Incus deployments and ownership.
Verify instance reachability and impact.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Incus and what is it used for?

Incus is an open-source tool that manages system containers and virtual machines. It allows developers and administrators to isolate applications, run multiple operating systems on a single physical host, and manage infrastructure resources efficiently.

What does CWE-59 mean for CVE-2026-63125?

CWE-59 refers to a weakness where software incorrectly handles symbolic links. In this case, Incus fails to properly validate a file path within a container image. Because the software follows a malicious link instead of staying within intended boundaries, it allows an attacker to manipulate files on the underlying host system.

How is this vulnerability triggered?

An attacker must have existing access as an unprivileged Incus user with permissions to create images and instances. The vulnerability is triggered only when the root daemon processes a crafted image containing a specifically linked backup file. Simply having access to the software or creating standard, non-malicious images does not activate this flaw.

Is my environment at risk from this CVE?

According to Halo Surface Signal, Incus is typically deployed within internal infrastructure or private cloud environments. While the vulnerability exists in the software, it is generally less accessible to external attackers than public-facing services. You should assess risk based on whether you allow untrusted users access to your Incus environment.

How do I secure my systems against this threat?

The primary response is to update your Incus software to version 7.3.0 or later, which includes the necessary security patch. Before applying the update, identify where Incus is running in your environment and coordinate with your infrastructure team to ensure the transition to the patched version is planned and implemented.

References

github.com/lxc/incus/security/advisories/GHSA-6rqx-22hc-qm36

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.