Is there a public PoC exploit available for CVE-2026-10565?

Yes, a public proof-of-concept exploit is available for CVE-2026-10565. Prioritise patching immediately. EPSS: 0.0%.

Is there a patch available for CVE-2026-10565?

Yes, a patch is available for CVE-2026-10565. Update the affected software to the latest version immediately.

Open5GS AMF CVE-2026-10565

Q: What is the CVSS score of CVE-2026-10565?

CVE-2026-10565 has a CVSS 4.0 base score of 1.3 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33871 LOW

Race Condition (CWE-362)

2026-06-02 VulDB

GHSA-94vg-m7v6-9c25

Information Disclosure Race Condition Open5gs

1.3

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

1.3 LOW

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jun 02, 2026 - 03:22 NVD

3.1 (LOW) 1.3 (LOW)

Source Code Evidence Fetched

Jun 02, 2026 - 02:45 vuln.today

Analysis Generated

Jun 02, 2026 - 02:45 vuln.today

DescriptionCVE.org

A security flaw has been discovered in Open5GS up to 2.7.6. The impacted element is the function gmm_state_security_mode of the file src/amf/gmm-sm.c of the component NGAP Handover. Performing a manipulation results in race condition. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitability is regarded as difficult. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.

AnalysisAI

Race condition in Open5GS AMF up to version 2.7.6 allows a remote, low-privileged attacker to trigger concurrent NGAP Security Mode Command processing in gmm_state_security_mode (src/amf/gmm-sm.c), resulting in low availability impact. Publicly available exploit code exists (N2-SMC-Concurrent.zip), though no public exploit identified at time of analysis indicates active exploitation and this CVE is not listed in CISA KEV. Notably, the associated fix PR (#4501) addresses a broader NGAP identity-scoping flaw - where the AMF accepted UE-associated NGAP messages from any gNB regardless of which gNB originally registered the UE - suggesting the underlying attack surface may exceed what the formal CVSS score of 3.1 captures.

Technical ContextAI

Open5GS is an open-source 5G core network stack implementing 3GPP Release 16/17. The affected component is the AMF (Access and Mobility Management Function), which manages UE registration, authentication, and mobility over the NGAP (Next Generation Application Protocol, TS 38.413) N2 interface connecting gNodeBs to the core. The root cause class is CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization), specifically in the Security Mode Command state machine (gmm_state_security_mode in gmm-sm.c). The upstream PR diff (PR #4501) reveals an additional structural flaw: ran_ue_find_by_amf_ue_ngap_id previously resolved a UE by AMF-UE-NGAP-ID without verifying that the resolving gNB matches the gNB that owns the UE's ran_ue record. Per TS 38.413 §10.6, NGAP message routing must be scoped to the originating gNB's logical NG-connection. The fix adds a gnb_id ownership check before returning a ran_ue pointer, refusing cross-gNB lookups. The CPE is cpe:2.3:a:n/a:open5gs:*:*:*:*:*:*:*:* indicating all tracked versions through 2.7.6.

RemediationAI

The upstream fix is available as PR #4501 (https://github.com/open5gs/open5gs/pull/4501), which awaits merge acceptance as of the time of reporting - a released patched version is not independently confirmed, so this should be treated as 'upstream fix available (PR/commit); released patched version not independently confirmed.' Operators should monitor the Open5GS release channel for the version incorporating this PR. In the interim, network-level compensating controls include restricting N2 interface access so only trusted gNodeBs (validated by SCTP endpoint authentication and mutual TLS where supported) can connect to the AMF - this directly limits which endpoints can send the concurrent NGAP messages required to trigger the race. Blocking untrusted gNB SCTP connections at the transport layer reduces exposure without disrupting legitimate UE traffic, though it requires maintaining an accurate gNB allowlist. Disabling NGAP handover handling entirely is not a viable workaround in production environments. Monitor the exploit archive at https://github.com/user-attachments/files/27111025/N2-SMC-Concurrent.zip for indicators of technique evolution.