Is there a public PoC exploit available for CVE-2026-8266?

Yes, a public proof-of-concept exploit is available for CVE-2026-8266. Prioritise patching immediately. EPSS: 0.0%.

Open5GS CVE-2026-8266

Q: What is the CVSS score of CVE-2026-8266?

CVE-2026-8266 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-29023 LOW

Improper Resource Shutdown or Release (CWE-404)

2026-05-11 VulDB

GHSA-cpxg-2cqw-2wjq

Denial Of Service Open5gs

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 11, 2026 - 04:22 NVD

MEDIUM LOW

CVSS changed

May 11, 2026 - 04:22 NVD

4.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

May 11, 2026 - 03:45 vuln.today

CVE Published

May 11, 2026 - 02:45 nvd

MEDIUM 4.3

DescriptionCVE.org

A vulnerability was detected in Open5GS up to 2.7.7. This affects the function gsm_build_pdu_session_establishment_accept of the file /src/smf/gsm-build.c of the component SMF. The manipulation results in denial of service. The attack can be launched remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Denial of service in Open5GS up to version 2.7.7 allows authenticated remote attackers to crash the Service Management Function (SMF) via manipulation of the PDU session establishment acceptance function, resulting in service unavailability. The CVSS score of 4.3 reflects low severity due to authentication requirements and availability-only impact, though publicly available exploit code exists and the vulnerability has been reported to the project without acknowledged response.

Technical ContextAI

Open5GS is a 5G Core implementation. The vulnerability exists in the SMF (Service Management Function) component, specifically in the gsm_build_pdu_session_establishment_accept function within /src/smf/gsm-build.c. This function is responsible for constructing PDU (Protocol Data Unit) session establishment accept messages in the 3GPP 5G signaling protocol. CWE-404 (Improper Resource Validation) indicates the root cause involves insufficient validation of resources or input when constructing or processing these session establishment messages. The SMF is a critical control-plane component that manages session establishment, modification, and release; disruption of this function impacts the 5G network's ability to provision data sessions.

RemediationAI

Upgrade Open5GS to a version newer than 2.7.7 once patched releases are available. Monitor the Open5GS GitHub repository (https://github.com/open5gs/open5gs) and the issue tracker (https://github.com/open5gs/open5gs/issues/4447) for patch announcements. As a temporary compensating control, restrict network access to the SMF component to trusted 5G network entities only, implementing network segmentation and firewall rules to allow PDU session establishment signaling only from authorized UE sources and trusted core network nodes. Alternatively, limit the privilege level of accounts that can initiate session establishment flows if the Open5GS deployment supports role-based access controls. Implement monitoring and alerting for SMF crashes or service restarts as an interim detection mechanism. These controls reduce attack surface but do not eliminate the vulnerability and should be replaced by patching as soon as available.