CVE-2026-43499 (GhostLock): Cozystack Exposure Assessment

Tue, 14 Jul 2026 00:00:00 +0000

Third CVE this week — but good news: Cozystack isn’t exposed by design, and the fix is the same v1.13.6 upgrade you already know. Details below.

TL;DR: CVE-2026-43499 (“GhostLock”) is a Linux kernel local privilege escalation. By the design of Cozystack, we currently see no viable attack path for a tenant to reach the affected host kernel surface. We still recommend the fix — and it is the same Talos v1.13.6 upgrade that closes Januscape (CVE-2026-53359) and CVE-2026-46113. One move to v1.13.6 closes all three.

Talos on Cozystack

CVE-2026-43499 (GhostLock): Cozystack Exposure Assessment