PatchTheCVECVE-2026-33542: Incus is a system container and virtual machine manager
CVE-2026-33542 is a medium-severity flaw (CVSS 4.8) affecting incus. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Incus is a system container and virtual machine manager. Prior to version 6.23.0, a lack of validation of the image fingerprint when downloading from simplestreams image servers opens the door to image cache poisoning and under very narrow circumstances exposes other tenants to running attacker controlled images rather than the expected one. Version 6.23.0 patches the issue.
Why this priority
- Public exploit reference
- Remotely exploitable, no login, no user action
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 4.8 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.2% (top 92%) |
| CISA exploited list | No |
| Weakness | CWE-295 |
| Published | 2026-03-26 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-33542?
incus: upgrade to 6.23.0. Exact commands for each OS are on this page.
Is CVE-2026-33542 being exploited?
CVE-2026-33542 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-33542 affect?
CVE-2026-33542 affects incus. Severity is medium (CVSS 4.8). Incus is a system container and virtual machine manager. Prior to version 6.23.0, a lack of validation of the image fingerprint when downloading from simplestreams image servers opens the door to image cache poisoning and under very narrow
How urgent is CVE-2026-33542?
Priority 34/100. Public exploit reference; Remotely exploitable, no login, no user action; On your watchlist
Related CVEs
- CVE-2026-41648 MEDIUM 5.0 UPGRADE Incus is a system container and virtual machine manager
- CVE-2026-41647 MEDIUM 6.5 UPGRADE Incus is a system container and virtual machine manager
- CVE-2026-41684 MEDIUM 6.5 UPGRADE Incus is a system container and virtual machine manager
- CVE-2026-41685 MEDIUM 4.3 UPGRADE Incus is a system container and virtual machine manager
- CVE-2026-40195 MEDIUM 6.5 UPGRADE Incus is a system container and virtual machine manager