OSNEXUS QuantaStor CVE-2026-18265

Exploitation requires network reachability to the QuantaStor Kapacitor interface, which is exposed without authentication per the ZDI advisory; the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no privileges and no user interaction are needed against affected installations. The concrete prerequisite is that the misconfigured Kapacitor service (default InfluxData port TCP 9092) is reachable from the attacker's position - that is the specific feature that must be exposed. The primary limiting factor is network exposure of that service: deployments that firewall or segment the management/storage network so Kapacitor is unreachable from untrusted hosts significantly constrain real-world exploitability, even though the flaw itself needs no credentials.

All available severity signals align. The CVSS 3.0 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) describes a network-reachable, low-complexity, unauthenticated flaw with no user interaction and full C/I/A impact, and the description independently confirms unauthenticated code execution as root - vector and prose agree, which raises confidence. No EPSS score was provided, so exploitation probability cannot be quantified, and no SSVC decision record is in the input. The vulnerability is NOT in CISA KEV and no POC was supplied, so there is no evidence of active exploitation or public exploit code yet; however, trivial preconditions, root-level impact, and a public ZDI advisory make this a genuine high-priority patch candidate rather than a high-CVSS-but-low-real-risk issue. The main uncertainty is real-world exposure: exploitation depends on the vulnerable Kapacitor interface being network-reachable, which may be limited in properly segmented storage deployments.

An attacker who can reach a QuantaStor appliance's Kapacitor interface connects to it directly, and because no authentication is enforced, submits a task or command that Kapacitor executes on the host. Since the service runs as root, the attacker obtains full root code execution without credentials or user interaction. No public POC was provided in the source data, but the low attack complexity makes reliable exploitation straightforward once the endpoint is exposed.