EUVD-2026-112306
GHSA-xrpv-r4cr-x2x4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInsufficient data to determine attack vector
-
ExploitAffected component not described in sources
-
ImpactImpact cannot be determined
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation prerequisites cannot be determined: the description is '[Unknown description]' and no CVSS vector (AV/AC/PR/UI) is supplied, so neither the required access level nor any configuration, feature, protocol, or deployment-mode precondition can be identified from the available sources. No limiting factors (user interaction, authentication level, non-default configuration, or specific platform/version) are stated in the input. The affected Ubuntu package and its trigger are not described in the available sources and must be obtained from the corresponding Ubuntu Security Notice before exploitation conditions can be assessed. |
| Impact | Risk cannot be meaningfully quantified from the supplied data. No CVSS base vector, no CVSS score, and no CWE are provided, so attack vector, complexity, privilege requirement, and impact are all unknown. There is no EPSS score, no CISA KEV listing, no SSVC exploitation/automatable/technical-impact signals, and no POC reference in the input, meaning exploitation status is 'no public exploit identified at time of analysis.' The only prioritization signal present is the vuln.today decision label 'this_month,' which indicates a moderate, non-emergency priority (not act_now or emergency) - consistent with a vulnerability that should be remediated on a routine monthly patch cadence rather than treated as an urgent out-of-band fix. The sole attribution is 'vendor:ubuntu,' suggesting the issue was reported or tracked via an Ubuntu security channel, but no affected package, version, or advisory is included to confirm this. Because the description is marked '[Unknown description],' no mechanism, affected component, or trigger condition can be established; any severity characterization here would be unsupported speculation. Bottom line: this is an underspecified record that cannot yet be confirmed as either a real priority or a high-CVSS-but-low-real-risk issue - the Ubuntu source and 'this_month' label should be used to pull the full advisory before any disposition. |
| Exploit ScenarioDerived | No exploit scenario can be responsibly constructed because the description is unknown and no CVSS vector, affected component, or trigger is provided. No POC or exploit reference is present in the input. The trigger is not described in the available sources. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
CVE-2026-116273 is an entry in the Ubuntu ecosystem reported by the vendor (vendor:ubuntu) with a vulnerability-management priority of 'this_month', but the record supplied to this analysis carries no description, no CVSS vector, no CWE classification, and no CPE data. Because neither the affected Ubuntu package nor the trigger condition is documented in the available sources, the impact an attacker could achieve, the access level required, and the deployment preconditions all remain undetermined; no public exploit code has been identified at time of analysis, and no EPSS score is available. Risk cannot be meaningfully quantified from the supplied data and must be re-assessed once the corresponding Ubuntu Security Notice is retrieved.
RemediationAI
No vendor-released patch version, workaround, or mitigation is described in the available input, and the affected Ubuntu package itself is not identified, so no specific fix level can be cited. The primary and currently only actionable step is to obtain the corresponding Ubuntu Security Notice for CVE-2026-116273 from Ubuntu's security notice and CVE tracker feeds, which will specify the affected source and binary packages, the releases in scope, and the fixed package versions to apply through the normal Ubuntu update channel. Until that notice is published and reviewed, no compensating control can be recommended with confidence, because the vulnerable component, its exposure, and the trigger are all undocumented; any interim measure would be speculative rather than evidence-based. Re-run this assessment once the USN provides package names and fixed versions.
Affected ProductsAI
Affected products cannot be enumerated at this time: the input provides no CPE strings, no package names, and no version ranges. The single attributable fact is that the issue is tracked by the Ubuntu vendor source (vendor:ubuntu), meaning the affected software is an Ubuntu-delivered package whose name and supported release branches (for example, the specific Ubuntu series and binary/source package impacted) appear only in the corresponding Ubuntu Security Notice. Consumers of Ubuntu packages should treat the affected package and version range as unconfirmed until that USN is located and should not assume coverage based on this record alone.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The only technical attributes available are the CVE identifier and the reporting source, vendor:ubuntu, indicating the issue was raised within Ubuntu's own security-tracking process (typically a package-level issue mirrored from an upstream project into a USN). No CWE is assigned in the input, so the root-cause class - memory corruption, injection, logic error, or otherwise - cannot be inferred and must not be assumed from the CVE being an Ubuntu entry. No CVSS vector components (AV/AC/PR/UI) are supplied, so the attack surface, whether the flaw is locally or remotely reachable, and whether authentication is required (the vector contains no PR:N or PR:L/PR:H token) all remain unconfirmed. Without a USN or upstream advisory, the underlying library, protocol, or subsystem involved in this Ubuntu package cannot be identified, and the trigger conditions are not described in the available sources.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
DescriptionCVE.org
[Unknown description]
Threat Intelligence Overview
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB