Is there a public PoC exploit available for CVE-2026-7536?

Yes, a public proof-of-concept exploit is available for CVE-2026-7536. Prioritise patching immediately. EPSS: 0.0%.

Open5GS CVE-2026-7536

Q: What is the CVSS score of CVE-2026-7536?

CVE-2026-7536 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-26469 MEDIUM

Improper Resource Shutdown or Release (CWE-404)

2026-05-01 VulDB

Denial Of Service Open5gs

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

May 01, 2026 - 15:26 vuln.today

Public exploit code

Analysis Generated

May 01, 2026 - 02:30 vuln.today

CVSS changed

May 01, 2026 - 02:22 NVD

5.3 (MEDIUM) 5.5 (MEDIUM)

EUVD ID Assigned

May 01, 2026 - 02:15 euvd

EUVD-2026-26469

Analysis Generated

May 01, 2026 - 02:15 vuln.today

CVE Published

May 01, 2026 - 01:15 nvd

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was determined in Open5GS up to 2.7.7. This vulnerability affects the function bsf_sess_add_by_ip_address of the file /nbsf-management/v1/pcfBindings of the component BSF. Executing a manipulation of the argument ipv4Addr can lead to denial of service. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Denial of service in Open5GS up to version 2.7.7 allows remote unauthenticated attackers to crash the BSF (Binding Support Function) service by manipulating the ipv4Addr parameter in the /nbsf-management/v1/pcfBindings endpoint. The vulnerability has publicly available exploit code and affects a core 5G network function, creating operational risk for mobile networks relying on this open-source implementation.

Technical ContextAI

Open5GS is an open-source 5G core network implementation. The vulnerability exists in the BSF component's bsf_sess_add_by_ip_address function, which handles the pcfBindings management API endpoint. The BSF is responsible for maintaining policy and charging rule function (PCF) bindings in the 5G service-based architecture. The root cause is classified as CWE-404 (Uncontrolled Resource Consumption), indicating that improper handling of the ipv4Addr argument allows an attacker to trigger resource exhaustion or invalid state conditions leading to service unavailability. The attack vector is network-based with low complexity, requiring no authentication or user interaction.

RemediationAI

Operators should upgrade Open5GS to a version newer than 2.7.7 as soon as a patched release is available. Check the Open5GS GitHub repository (https://github.com/open5gs/open5gs) and the issue tracker (https://github.com/open5gs/open5gs/issues/4400) for patch releases; at the time of this analysis, no vendor-released patch version has been independently confirmed in the input data. As an interim compensating control, implement network-level filtering on the /nbsf-management/v1/pcfBindings endpoint to restrict inbound API traffic to known, trusted PCF instances only. This reduces the attack surface by blocking unauthenticated remote requests from untrusted sources, though it does not address the underlying code defect. Additionally, monitor BSF process stability and implement automated restart policies for the BSF service in orchestrated deployments to minimize downtime from DoS events. Contact the Open5GS project maintainers directly via the GitHub issue (https://github.com/open5gs/open5gs/issues/4400) to request patching timeline and interim guidance.