PatchTheCVECVE-2026-40243: Incus is a system container and virtual machine manager
CVE-2026-40243 is a medium-severity flaw (CVSS 4.8) affecting incus. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Incus is a system container and virtual machine manager. In versions before 7.0.0, broken TLS validation logic in the OVN database connection logic can allow connections to an attacker's OVN database. The OVN client implementations disable Go standard TLS server verification and replace it with custom peer-certificate verification logic. That replacement verifier does not anchor trust in the configured CA certificate. Instead, it constructs the v
Why this priority
- Public exploit reference
- Remotely exploitable, no login, no user action
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 4.8 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.2% (top 93%) |
| CISA exploited list | No |
| Weakness | CWE-295 |
| Published | 2026-05-06 |
| Last modified | 2026-10-26 |
Last updated 2026-10-26 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-40243?
incus: upgrade to 7.0.0. Exact commands for each OS are on this page.
Is CVE-2026-40243 being exploited?
CVE-2026-40243 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-40243 affect?
CVE-2026-40243 affects incus. Severity is medium (CVSS 4.8). Incus is a system container and virtual machine manager. In versions before 7.0.0, broken TLS validation logic in the OVN database connection logic can allow connections to an attacker's OVN database. The OVN client implementations disable
How urgent is CVE-2026-40243?
Priority 33/100. Public exploit reference; Remotely exploitable, no login, no user action; On your watchlist
Related CVEs
- CVE-2026-41684 MEDIUM 6.5 UPGRADE Incus is a system container and virtual machine manager
- CVE-2026-41685 MEDIUM 4.3 UPGRADE Incus is a system container and virtual machine manager
- CVE-2026-40195 MEDIUM 6.5 UPGRADE Incus is a system container and virtual machine manager
- CVE-2026-40197 MEDIUM 6.5 UPGRADE Incus is a system container and virtual machine manager
- CVE-2026-40251 MEDIUM 6.5 UPGRADE Incus is a system container and virtual machine manager