The iscsi-initiator-utils package provides the server daemon and utilities for managing the iSCSI protocol, which enables distributed disk access over IP networks. Two security flaws were fixed: CVE-2026-44944 involves an authentication bypass vulnerability in the iscsiuio control socket, and CVE-2026-44943 involves privilege escalation through a path traversal vulnerability. These issues could allow unauthorized access or privilege escalation on affected systems. Red Hat issued a security advisory (RHSA-2026:53844) with patches for Red Hat Enterprise Linux 9 across multiple architectures. Additional bug fixes and enhancements were also included in the update.

Successful exploitation of CVE-2026-44944 could allow an attacker to bypass authentication controls in the iscsiuio control socket, potentially gaining unauthorized access. CVE-2026-44943 could allow privilege escalation via a path traversal attack, enabling an attacker to gain elevated privileges on the system. Both vulnerabilities pose significant security risks to systems running affected versions of iscsi-initiator-utils, potentially compromising system integrity and security.

Red Hat has released an official security update for iscsi-initiator-utils in Red Hat Enterprise Linux 9 that addresses these vulnerabilities. Users should apply the update as described in the Red Hat advisory RHSA-2026:53844 to remediate these issues. For detailed instructions, refer to https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official patch.