Is there a public PoC exploit available for CVE-2026-8267?

Yes, a public proof-of-concept exploit is available for CVE-2026-8267. Prioritise patching immediately. EPSS: 0.0%.

Open5GS CVE-2026-8267

Q: What is the CVSS score of CVE-2026-8267?

CVE-2026-8267 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-29024 LOW

Improper Resource Shutdown or Release (CWE-404)

2026-05-11 VulDB

GHSA-gwx7-3cpr-h65f

Denial Of Service Open5gs

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 11, 2026 - 04:22 NVD

MEDIUM LOW

CVSS changed

May 11, 2026 - 04:22 NVD

4.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

May 11, 2026 - 03:45 vuln.today

CVE Published

May 11, 2026 - 03:00 nvd

MEDIUM 4.3

DescriptionCVE.org

A flaw has been found in Open5GS up to 2.7.7. This vulnerability affects the function smf_nsmf_handle_created_data_in_vsmf of the component SMF. This manipulation causes denial of service. The attack may be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Remote authenticated denial of service in Open5GS up to version 2.7.7 affects the SMF (Session Management Function) component, specifically in the smf_nsmf_handle_created_data_in_vsmf function. An authenticated attacker can remotely trigger a denial of service condition by sending crafted requests. Public exploit code is available (CVE-2026-8267 GitHub issue #4448), though the vendor has not yet released a patched version despite early notification.

Technical ContextAI

Open5GS is an open-source implementation of 5G core network functions. The vulnerability resides in the SMF (Session Management Function) component, which handles session management and policy enforcement in 5G networks. The flaw is classified as CWE-404 (Uncontrolled Resource Consumption), indicating improper resource handling that can be exhausted by malicious input. The smf_nsmf_handle_created_data_in_vsmf function processes incoming data related to VSMF (Virtual SMF) interactions; a crafted payload to this function triggers resource exhaustion or improper state handling, rendering the SMF unavailable.

RemediationAI

No vendor-released patched version has been identified at time of analysis. The Open5GS project has not responded to early notification despite public disclosure. Operators should immediately review Open5GS deployments and consider the following mitigations: (1) Restrict network access to SMF components to trusted internal networks only, eliminating remote attack vector; (2) Implement strong authentication and access control for SMF interfaces, enforcing mutual TLS with certificate pinning; (3) Monitor SMF resource consumption (CPU, memory, connection counts) for anomalies indicating resource exhaustion attacks; (4) Deploy rate limiting on SMF NSMF interfaces to throttle requests from individual sources; (5) Consider transitioning to alternative 5G core implementations or await Open5GS response and patch release. Each mitigation trades off operational flexibility or processing latency. Check GitHub issue #4448 and VulDB #362564 for vendor updates.