Is there a public PoC exploit available for CVE-2026-8268?

Yes, a public proof-of-concept exploit is available for CVE-2026-8268. Prioritise patching immediately. EPSS: 0.0%.

Open5GS CVE-2026-8268

Q: What is the CVSS score of CVE-2026-8268?

CVE-2026-8268 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-29025 LOW

Improper Resource Shutdown or Release (CWE-404)

2026-05-11 VulDB

GHSA-7g8j-9f3m-5jcf

Denial Of Service Open5gs

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 11, 2026 - 04:22 NVD

MEDIUM LOW

CVSS changed

May 11, 2026 - 04:22 NVD

4.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

May 11, 2026 - 03:45 vuln.today

CVE Published

May 11, 2026 - 03:15 nvd

MEDIUM 4.3

DescriptionCVE.org

A vulnerability has been found in Open5GS up to 2.7.7. This issue affects the function OpenAPI_list_create of the component SMF. Such manipulation leads to denial of service. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Denial of service in Open5GS up to version 2.7.7 affects the SMF component's OpenAPI_list_create function, allowing authenticated remote attackers to cause service unavailability through resource manipulation. The vulnerability has low to moderate severity (CVSS 4.3) with publicly disclosed proof-of-concept code, though the vendor has not yet responded to early disclosure notification.

Technical ContextAI

Open5GS is an open-source implementation of 5G core network functions. The vulnerability resides in the Service Mobility Function (SMF) component, specifically in the OpenAPI_list_create function which handles list creation operations via the OpenAPI interface. The issue is classified as CWE-404 (Improper Resource Validation), suggesting the function fails to properly validate or limit resource allocation when processing list creation requests, potentially allowing exhaustion of memory, file handles, or other critical resources. The SMF is a control-plane component responsible for session management in 5G networks, making this DoS vector particularly relevant to network availability.

RemediationAI

Upgrade Open5GS to a version beyond 2.7.7 once the vendor releases a patched version; currently, no vendor-released patch is confirmed. As an immediate compensating control, restrict network access to the SMF OpenAPI interface by implementing authentication at the network perimeter (API gateway, firewall rules, or reverse proxy authentication) to ensure only trusted administrative or service users can interact with the SMF. Additionally, implement rate limiting and resource quotas on OpenAPI list creation requests to prevent exhaustion attacks even from authenticated sources. Monitor SMF process memory and resource utilization for anomalies that may indicate active exploitation. If operation cannot proceed without public SMF API exposure, consider deploying the SMF in an isolated network segment or virtual security appliance with strict ingress/egress filtering until a patch is available. Note that these controls introduce administrative overhead and may impact legitimate SMF automation workflows if rate limits are too restrictive.