CVE-2026-41685 — Incus is a system container and virtual machine manager.

title: Incus Large Data Upload Exhausting Disk Space - CVE-2026-41685
id: scw-2026-05-07-ai-1
status: experimental
level: medium
description: |
  Detects the execution of the 'incus' binary with commands related to storage creation, which could indicate an authenticated user attempting to upload a large amount of data to exhaust disk space, as described in CVE-2026-41685. This rule targets the core vulnerability where large uploads by authenticated users can lead to disk space exhaustion.
author: SCW Feed Engine (AI-generated)
date: 2026-05-07
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-41685/
tags:
  - attack.defense_evasion
  - attack.t1499
logsource:
    category: process_creation
detection:
  selection:
      Image|endswith:
          - '/incus'
      CommandLine|contains:
          - 'storage.create'
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse