Is there a public PoC exploit available for CVE-2026-7780?

Yes, a public proof-of-concept exploit is available for CVE-2026-7780. Prioritise patching immediately. EPSS: 0.0%.

Open5GS CVE-2026-7780

Q: What is the CVSS score of CVE-2026-7780?

CVE-2026-7780 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-27148 LOW

Improper Resource Shutdown or Release (CWE-404)

2026-05-04 VulDB

Denial Of Service Open5gs

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 04, 2026 - 22:30 vuln.today

Severity Changed

May 04, 2026 - 22:22 NVD

MEDIUM LOW

CVSS changed

May 04, 2026 - 22:22 NVD

4.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A weakness has been identified in Open5GS up to 2.7.7. Affected by this vulnerability is the function udm_state_operational of the file /src/udm/udm-sm.c of the component smf-registrations Endpoint. Executing a manipulation can lead to denial of service. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Denial of service in Open5GS up to version 2.7.7 affects the udm_state_operational function in the smf-registrations endpoint, allowing authenticated remote attackers to manipulate the function and cause service unavailability. The vulnerability has publicly available exploit code and carries a low CVSS score of 2.1 due to required authentication and limited availability impact, though the project has not yet responded to early disclosure.

Technical ContextAI

Open5GS is an open-source 5G Core and LTE network implementation. The vulnerability exists in the User Data Management (UDM) component, specifically in the smf-registrations endpoint handler within /src/udm/udm-sm.c. The udm_state_operational function processes state management requests, and the weakness (CWE-404: Improper Resource Validation) allows an authenticated user to send a crafted request that causes the function to fail or behave unexpectedly, resulting in denial of service. This is a resource validation flaw where input manipulation is not properly validated before state transitions are processed.

RemediationAI

Upgrade Open5GS to a version newer than 2.7.7 once a patched release becomes available. Pending patch availability, implement network-level mitigations: restrict access to the smf-registrations endpoint to authorized SMF instances only using firewall rules or API gateway policies; disable or restrict SMF registration features if not required for operations; implement rate limiting on UDM endpoints to reduce denial of service impact; monitor UDM logs for repeated failed state transitions or manipulation attempts from authenticated sources. Check the Open5GS GitHub repository (https://github.com/open5gs/open5gs) and issue #4419 for patch availability and updates.