RHSA-2026:60428 — Security Advisory

An update for iscsi-initiator-utils is now available for Red Hat Enterprise Linux 9.6 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The iscsi-initiator-utils packages provide the server daemon for the Internet Small Computer System Interface (iSCSI) protocol, as well as the utility programs used to manage it. The iSCSI protocol is a protocol for distributed disk access using SCSI commands sent over Internet Protocol (IP) networks.

Security Fix(es):

• open-iscsi: open-iscsi: Authentication bypass in iscsiuio control socket (CVE-2026-44944)

• open-iscsi: open-iscsi: Privilege Escalation via Path Traversal (CVE-2026-44943)

Bug Fix(es) and Enhancement(s):

• [FJ9.7 Bug][REG]: iscsiadm reports node.discovery_type as "fw", although it should be "static". [rhel-9.6.z] (JIRA:RHEL-191896)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.