What is the CVSS score of CVE-2026-49838?

CVE-2026-49838 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Is there a public PoC exploit available for CVE-2026-49838?

Yes, a public proof-of-concept exploit is available for CVE-2026-49838. Prioritise patching immediately. EPSS: 0.3%.

Is there a patch available for CVE-2026-49838?

Yes, a patch is available for CVE-2026-49838. Update the affected software to the latest version immediately.

Ubuntu CVE-2026-49838

MEDIUM

Improper Validation of Array Index (CWE-129)

2026-07-03 vendor:ubuntu

GHSA-frrj-87jh-2772

Information Disclosure

5.9

CVSS 3.1 · Vendor: vendor:ubuntu

Severity by source

Vendor (vendor:ubuntu) PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

SUSE

MEDIUM

qualitative

Primary rating from Vendor (vendor:ubuntu).

CVSS VectorVendor: vendor:ubuntu

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVSS changed

Sep 10, 2026 - 22:22 NVD

5.9 (MEDIUM)

Analysis Generated

Jul 04, 2026 - 08:00 vuln.today

DescriptionCVE.org

[Unknown description]

AnalysisAI

CVE-2026-49838 is a vulnerability reported by Ubuntu with no description, CVSS score, CWE classification, or technical detail available at time of analysis. The CVE identifier falls in the 2026 range, suggesting this may be a recently reserved or embargoed entry. No impact, affected component, or exploitation vector can be determined from the provided data.

Technical ContextAI

No technical context is derivable from the available data. The sole intelligence signal is attribution to 'vendor:ubuntu', which indicates Ubuntu (Canonical) as the reporting source. Without a description, CWE, or CPE strings, the affected package, library, or subsystem within the Ubuntu ecosystem cannot be identified. Ubuntu publishes security advisories via the Ubuntu Security Notices (USN) portal, which should be consulted directly for authoritative details.

Affected ProductsAI

No affected products or version ranges can be identified. The reporting source is Ubuntu, but no CPE strings, package names, version constraints, or vendor advisory URLs were provided. Analysts should query the Ubuntu CVE Tracker and USN portal directly for affected package and version information.

RemediationAI

No remediation can be specified - no patch version, advisory URL, or vulnerability description is available. Security teams should monitor the Ubuntu Security Notices portal and the NVD entry for CVE-2026-49838 for updates. Until details are published, no targeted compensating controls can be recommended without risk of misapplication.