EUVD-2026-89133
GHSA-gwgr-7jjq-3vmv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInsufficient data to determine attack vector
-
ExploitUnknown vulnerability class prevents chain reconstruction
-
ImpactImpact undetermined
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Incorrectly specified target
|
| Exploitation Conditions | Cannot be determined - the CVE record supplied contains no description, no CVSS vector, and no affected-product identification, so no specific feature, protocol, configuration setting, deployment mode, authentication level, or user-interaction prerequisite can be extracted. Enrichment from NVD or the upstream vendor/Ubuntu advisory is required before exploitation conditions can be stated. |
| Impact | Risk cannot be meaningfully assessed from the available data. There is no CVSS score or vector (attack vector, complexity, and privilege requirements are all unknown), no CWE, no EPSS probability, no CISA KEV listing, and no POC reference. The sole signal is that the entry was surfaced by a distro tracker ('vendor:ubuntu'), which indicates the CVE identifier exists and was ingested into Ubuntu's security tracking, but conveys nothing about the affected component, attack surface, or impact. With no description text, it is impossible to distinguish a critical remote flaw from a low-severity local issue. This should be treated as an unscored placeholder requiring enrichment from an upstream source (NVD, the affected project's advisory, or the Ubuntu USN/CVE tracker page) before any prioritization decision. No key signals conflict because no key signals are present - the assessment is simply data-starved. |
| Exploit ScenarioDerived | No exploit scenario can be constructed because the vulnerability class, affected product, and attack vector are all unknown. No public exploit code is referenced in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Risk cannot be meaningfully assessed from the available data - CVE-2026-95275 exists only as a bare record attributed to the Ubuntu vendor source, with no description, no CVSS vector, no CWE classification, and no affected-product identification. Because neither the vulnerable component nor the attack surface is known, it is impossible to state what an attacker could accomplish, which Ubuntu release or package is implicated, or whether exploitation would require authentication, local access, or user interaction. The record carries no CISA KEV listing, no publicly available exploit code, and no EPSS signal, so the only defensible posture is to treat the identifier as unverified and pending enrichment from NVD or the Ubuntu security advisory before any risk statement is issued.
RemediationAI
No patch or fix version is indicated in the supplied data, so no specific upgrade target can be cited and patch status must be treated as indeterminate rather than confirmed absent. The actionable first step is to open the Ubuntu CVE tracker page for CVE-2026-95275 and the linked USN to obtain the affected source packages, the fixed version per release, and the required apt upgrade commands; subscribe to the ubuntu-security-announce list to receive the USN when it is issued. Because the attack surface, affected component, and exploitation prerequisites are all unknown, no specific compensating control can be recommended without risking wasted effort or false assurance - measures such as disabling a feature, blocking a port, or restricting an endpoint cannot be justified when the vulnerable subsystem has not been identified. Operational trade-offs therefore favour detection and readiness over pre-emptive mitigation: ensure unattended-upgrades or an equivalent patch pipeline is functioning on all Ubuntu hosts so that a fix can be deployed promptly once released, and retain sufficient logging to investigate anomalous activity on systems running Ubuntu. Any hardening change made before the advisory is published should be treated as provisional and re-evaluated once the affected package and attack vector are known.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
There is effectively no technical substrate to analyze here: the supplied record contains no description text, no CWE mapping, no CPE strings, and no CVSS vector, so the underlying technology, library, protocol, or subsystem cannot be identified. The sole provenance signal is the attribution 'vendor:ubuntu', which indicates the Ubuntu security team is the reporting source - a pattern typical of Ubuntu Security Notices (USNs), where a single CVE may map to one or more source packages, backported patches, or kernel subsystems across multiple supported releases (LTS and interim). Without CPE data there is no way to enumerate affected package names, version ranges, or whether the issue is in upstream code or in a Debian/Ubuntu-specific patch. Similarly, the absence of a CWE means the root-cause class (for example injection, memory corruption, access control, or cryptographic weakness) is entirely unknown, and the absence of a CVSS vector means neither the privilege-required (PR) nor the attack-vector (AV) component can be derived. Any attempt to characterize the flaw class, the affected component, or the exploitation prerequisites at this stage would be speculation rather than analysis.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: vendor:ubuntu
Lifecycle Timeline
1DescriptionCVE.org
[Unknown description]
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB