Linux Foundation Magma CVE-2026-82547

The target must be running Linux Foundation Magma 1.9.0 with the AMF component reachable over the network - specifically the NAS (Non-Access Stratum) signaling path on the N1 interface used for UE-to-AMF communication. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no special configuration, authentication, or user interaction is required - the registration handler is inherently exposed to network-originating UE messages by design. Exploitation is limited in practice by the specialized deployment context: Magma is a telecom-grade mobile core platform, so reachable instances are primarily operated by carriers, MVNOs, private LTE/5G network operators, or telecom research environments, not general internet-facing infrastructure. There is no indication of a non-default configuration requirement beyond having the AMF role active.

The CVSS 4.0 score of 6.9 (Medium) reflects a network-accessible, low-complexity, unauthenticated attack path (AV:N/AC:L/AT:N/PR:N/UI:N) with bounded impact: low integrity (VI:L) and low availability (VA:L) on the vulnerable system, with no confidentiality or subsequent-system impact (SC/SI/SA:N). The E:P exploitability supplement confirms a publicly available POC, elevating practical risk above the base score alone. No CISA KEV entry is present, and EPSS data was not provided - exploitation appears to be demonstrated but not confirmed as actively weaponized in production environments. The specialized deployment context (5G mobile core networks operated by carriers, research institutions, or MVNOs) substantially limits the population of reachable targets, but operators who are exposed face meaningful risk: authentication bypass in an AMF registration handler could allow rogue devices to manipulate registration state, potentially disrupting subscriber management or enabling unauthorized network access. The CPE wildcard version field is a data quality concern - it is not confirmed whether versions prior to 1.9.0 are also affected.

An attacker with network access to the AMF's NAS signaling interface crafts a spoofed 5G Registration Complete NAS message and transmits it to the Magma AMF component. The amf_fsm.cpp handler processes the message without adequately verifying the sender's identity, allowing the attacker to manipulate AMF registration state. A public POC is available on GitHub (issue #16020), meaning the attack path has been demonstrated and could be adapted by moderately skilled actors targeting exposed Magma deployments.