Is there a public PoC exploit available for CVE-2026-7706?

Yes, a public proof-of-concept exploit is available for CVE-2026-7706. Prioritise patching immediately. EPSS: 0.0%.

Open5GS CVE-2026-7706

Q: What is the CVSS score of CVE-2026-7706?

CVE-2026-7706 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

LOW

Improper Resource Shutdown or Release (CWE-404)

2026-05-03 VulDB

Denial Of Service Open5gs

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 03, 2026 - 23:22 NVD

MEDIUM LOW

CVSS changed

May 03, 2026 - 23:22 NVD

4.3 (MEDIUM) 2.1 (LOW)

PoC Detected

May 03, 2026 - 23:16 vuln.today

Public exploit code

Analysis Generated

May 03, 2026 - 23:00 vuln.today

Analysis Generated

May 03, 2026 - 22:45 vuln.today

CVE Published

May 03, 2026 - 22:15 nvd

LOW 2.1

DescriptionCVE.org

A vulnerability has been found in Open5GS up to 2.7.7. This issue affects the function gmm_handle_service_request of the file /src/amf/gmm-handler.c of the component AMF. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Denial of service in Open5GS versions up to 2.7.7 allows authenticated remote attackers to crash the AMF (Access and Mobility Management Function) component by exploiting improper error handling in the gmm_handle_service_request function. The vulnerability requires low-privilege authentication to trigger and results in service unavailability. A public exploit has been disclosed via GitHub issue tracker, though the vendor has not yet released a patch despite early notification.

Technical ContextAI

Open5GS is an open-source 5G core network implementation. The vulnerability exists in the Access and Mobility Management Function (AMF), which handles signaling procedures for mobile device attachment and service requests in 5G networks. The affected function gmm_handle_service_request in /src/amf/gmm-handler.c implements GMM (GPRS Mobility Management) procedures. CWE-404 (Improper Resource Validation) indicates the root cause is inadequate validation or error handling when processing service request messages from authenticated users, allowing an attacker to send malformed or unexpected input that causes the AMF process to terminate abnormally.

RemediationAI

No vendor-released patch identified at time of analysis. The Open5GS project was notified early via GitHub issue #4409 but has not yet responded with a fix or workaround guidance. Operators should monitor the official Open5GS GitHub repository (https://github.com/open5gs/open5gs/) for patch availability. Interim mitigation options include: (1) Implement rate limiting or connection throttling on the AMF to reduce rapid service request floods, though this may degrade user experience during legitimate traffic spikes; (2) Restrict AMF access to trusted UE/network segments via firewall or network segmentation, limiting the attack surface to known devices; (3) Deploy AMF process monitoring with automatic restart on unexpected termination to reduce outage duration; (4) Upgrade to a version newer than 2.7.7 if available upstream, pending vendor patch release. Each mitigation trades off operational complexity or user-facing performance for reduced DoS impact. Organizations should contact the Open5GS maintainers directly to request patch priority if running production deployments.