Linux iSCSI tgt · Disclosed

Researcher announces zero-day RCE in Linux iSCSI tgt daemon

Oct 28, 2026 · 1 min read

Researcher @bl4sty announced a zero-day remote code execution flaw in tgt, the Linux iSCSI target daemon. The announcement, made on social media on October 28, 2026, cites no CVE and no fix. The researcher's immediate advice is to remove networked block storage servers from the internet.

By HIFY Radar newsroom Updated 10/28/2026 07:45 AM Get this every day →← Back to the feed 1 source

HighVulnerabilityDisclosedFix unconfirmed

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

Researcher @bl4sty announced a zero-day remote code execution flaw in tgt, the Linux iSCSI target daemon. The announcement was made on social media, with no technical details. It urges removal of networked block storage servers from the internet.

Why it matters

If confirmed and exploited, the flaw could let attackers run code on exposed storage servers, putting corporate disks and data at direct risk. Companies using iSCSI storage are potentially exposed until a fix exists.

What to do

Immediately remove any externally reachable iSCSI target from the internet and restrict access to the internal network. Watch for a tgt fix and apply it as soon as one is released.

For the technical team

Affected: Linux iSCSI tgt (daemon de alvo iSCSI do Linux) · Servers with network-reachable iSCSI targets. Versions not specified in the announcement.
Exploitation: No exploitation reported in the sources and no PoC cited. The flaw was disclosed as a 0day by researcher @bl4sty on social media.
Fix: No fix cited in the announcement. No CVE mentioned.
Vector: Componentent: tgt, the Linux iSCSI target daemon. Type: remote code execution, disclosed as zero-day. Exploitation condition and prerequisites were not disclosed; the researcher's warning points to risk in network-reachable iSCSI targets.
More details: Announcement posted by researcher @bl4sty on X on 2026-10-28 at 10:45, with no technical details, CVE, or patch. The announcement itself advises removing networked block devices from the internet. The claim comes from the researcher alone, with no vendor confirmation.