Which versions of Ericsson Packet Core Gateway are affected by CVE-2026-25659?

Ericsson Packet Core Gateway versions prior to 1.30 are vulnerable to a denial-of-service attack that can degrade critical telecom packet-processing services when targeted continuously from an…. A patch is available.

How to fix or mitigate CVE-2026-25659?

24 hours: Audit all Ericsson PCG deployments to identify versions prior to 1.30, enable detailed monitoring for abnormal traffic patterns that could trigger CWE-230 conditions. 7 days: Implement network segmentation restricting adjacent-network access to PCG interfaces, enable rate limiting on control-plane messages, and establish alerting for availability anomalies. 30 days: Monitor Ericsson security advisories for patch release (upgrade target: PCG 1.30 or later), conduct controlled upgrade testing in non-production environment, and document incident response procedures.

Ericsson Packet Core Gateway CVE-2026-25659

Q: What is the CVSS score of CVE-2026-25659?

CVE-2026-25659 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34823 HIGH

Improper Handling of Missing Values (CWE-230)

2026-06-05 ERIC

GHSA-pg3r-xmvg-gj6m

Ericsson Denial Of Service

7.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 05, 2026 - 13:01 EUVD

Analysis Generated

Jun 05, 2026 - 12:26 vuln.today

CVSS changed

Jun 05, 2026 - 12:22 NVD

7.1 (HIGH)

DescriptionCVE.org

Ericsson Packet Core Gateway (PCG) versions prior to 1.30 contain an Improper Handling of Missing Values (CWE-230) vulnerability where an attacker continuously sending a specially crafted message can cause service degradation. The impact continues as long the attack persists but the system recovers from the crashes when the attack stops.

AnalysisAI

Denial of service in Ericsson Packet Core Gateway (PCG) versions prior to 1.30 allows an adjacent-network attacker to degrade telecom packet core service by continuously sending a specially crafted message that triggers improper handling of missing values (CWE-230). The condition persists only while the attack is sustained - the system self-recovers once traffic stops - and no public exploit identified at time of analysis, but the CVSS 4.0 score of 7.1 reflects high availability impact on a carrier-grade network function.

Technical ContextAI

PCG is Ericsson's cloud-native 5G packet core element that combines SMF (Session Management Function) and UPF (User Plane Function) roles for subscriber session handling and user-plane traffic forwarding in mobile operator networks. The root cause is CWE-230 (Improper Handling of Missing Values), meaning a parser or message handler does not safely cope with a field that is absent or null in an inbound protocol message, leading it to crash rather than reject the malformed input. Because PCG sits on the operator's signaling/transport network (consistent with the AV:A 'adjacent network' attack vector), the offending message must reach an internal control or user-plane interface rather than the public internet.

RemediationAI

Upgrade Ericsson Packet Core Gateway to version 1.30 or later, which is the vendor-released patch identified in the Ericsson PSIRT advisory at https://www.ericsson.com/en/about-us/security/psirt/cve-2026-25659. If immediate upgrade is not feasible in a maintenance window, compensating controls focus on shrinking the adjacent-network attack surface: restrict signaling and N3/N4/N6 interface reachability to known peer NF (Network Function) IP ranges via firewall ACLs at the data-center fabric, enforce IPsec/TLS mutual authentication on inter-NF traffic where supported (limits message origination to authenticated peers but adds CPU overhead), and enable rate limiting on the affected ingress interface to blunt the sustained-traffic requirement (may drop legitimate bursty signaling during peaks). Monitor PCG process restart counts and N4/PFCP error metrics as a detective control until the patch is deployed.