Is there a public PoC exploit available for CVE-2026-8743?

Yes, a public proof-of-concept exploit is available for CVE-2026-8743. Prioritise patching immediately. EPSS: 0.0%.

Is there a patch available for CVE-2026-8743?

Yes, a patch is available for CVE-2026-8743. Update the affected software to the latest version immediately.

Open5GS CVE-2026-8743

Q: What is the CVSS score of CVE-2026-8743?

CVE-2026-8743 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-30691 LOW

Improper Authorization (CWE-285)

2026-05-17 VulDB

GHSA-9vhj-8h2m-3g3m

Authentication Bypass Open5gs

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 17, 2026 - 10:22 NVD

MEDIUM LOW

CVSS changed

May 17, 2026 - 10:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

Source Code Evidence Fetched

May 17, 2026 - 09:45 vuln.today

Analysis Generated

May 17, 2026 - 09:45 vuln.today

DescriptionCVE.org

A vulnerability was found in Open5GS up to 2.7.6. This impacts the function ran_ue_find_by_amf_ue_ngap_id of the file src/amf/context.c of the component AMF/MME. Performing a manipulation results in improper authorization. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The patch is named 5746b8576cfceec18ed87eb7d8cf11b1fb4cd8b1. It is suggested to install a patch to address this issue.

AnalysisAI

Improper authorization in Open5GS AMF/MME component (versions up to 2.7.6) allows authenticated network attackers to manipulate NGAP user context lookups, potentially accessing or interfering with other users' 5G/LTE sessions. The vulnerability stems from insufficient validation of AMF_UE_NGAP_ID and RAN_UE_NGAP_ID pairs in the ran_ue_find_by_amf_ue_ngap_id function, enabling attackers with low-level network privileges to bypass session-to-base-station association controls. Publicly available exploit code exists (GitHub issue #4498), and a vendor-released patch (commit 5746b857) is available. CVSS 6.3 (Medium) reflects network vector with low attack complexity but requires authentication.

Technical ContextAI

Open5GS is an open-source implementation of 5G Core and EPC (Evolved Packet Core) for mobile networks. The vulnerability affects the AMF (Access and Mobility Management Function) in 5G and MME (Mobility Management Entity) in LTE, specifically in NGAP (NG Application Protocol) message handling within src/amf/context.c. The root cause is CWE-285 (Improper Authorization), where the ran_ue_find_by_amf_ue_ngap_id function looked up RAN UE contexts by AMF_UE_NGAP_ID alone without validating that the corresponding RAN_UE_NGAP_ID belonged to the same gNB (5G base station) session. The patch introduces ngap_find_ran_ue_by_message_ue_ids, which cross-validates both identifiers and verifies gnb_id association, preventing an attacker from using a valid AMF_UE_NGAP_ID with a mismatched RAN_UE_NGAP_ID from a different base station to manipulate session state.

RemediationAI

Upgrade to Open5GS version containing commit 5746b8576cfceec18ed87eb7d8cf11b1fb4cd8b1 or apply the patch from pull request #4553 (https://github.com/open5gs/open5gs/pull/4553). The patch replaces vulnerable ran_ue_find_by_amf_ue_ngap_id calls with ngap_find_ran_ue_by_message_ue_ids, which validates both AMF_UE_NGAP_ID and RAN_UE_NGAP_ID consistency and verifies gnb_id association before processing NGAP messages. If immediate patching is not feasible, implement compensating controls: restrict NGAP interface access to authenticated base stations with mutual TLS and per-gNB certificate validation (note: adds infrastructure overhead and may require reconfiguring all base stations), enable detailed NGAP message logging to detect anomalous AMF_UE_NGAP_ID/RAN_UE_NGAP_ID pairings (increases storage/processing costs), and deploy network segmentation isolating AMF/MME from untrusted network elements (may break legitimate roaming scenarios). Workarounds do not eliminate the vulnerability and should be treated as temporary mitigations only.