EUVD-2026-89247
GHSA-cpxw-9362-2p72
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessUnknown vector
-
ExploitUnknown weakness
-
ImpactUnknown impact
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Cannot be determined - the description is missing entirely and no CVSS vector is provided, so required privileges, user interaction, configuration prerequisites, protocol, and affected feature are all unknown. Consult the Ubuntu CVE tracker / USN entry for CVE-2026-95287 and the upstream project advisory to establish concrete preconditions and limiting factors. |
| Impact | Risk cannot be meaningfully assessed from the available data. There is no CVSS base score or vector (so attack vector, complexity, privileges, and scope are all unknown), no EPSS probability, no CISA KEV listing, and no public POC referenced. The only signal is that the record was reported by the Ubuntu security team (vendor:ubuntu), which typically indicates a vulnerability in a software package tracked in the Ubuntu distribution, but neither the affected package nor the vulnerability class is provided. No exploitation status can be inferred: no public exploit identified at time of analysis. Any prioritization decision must be deferred until the Ubuntu Security Notice (USN) / CVE tracker entry for CVE-2026-95287 and the upstream advisory are obtained; treating this as high or low risk now would be guessing rather than analysis. |
| Exploit ScenarioDerived | No exploit scenario can be constructed because the vulnerability class, affected component, and attack vector are all absent from the input. No POC or exploit code is referenced. Once the affected Ubuntu package and CVSS vector are known, a realistic scenario can be written. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
The security impact of CVE-2026-95287 on Ubuntu cannot be determined from the intelligence currently available, because the vulnerability description is entirely missing and no CVSS score or vector, CWE classification, or CPE data was supplied. The only attributable data point is that the record was reported through the Ubuntu vendor feed (vendor:ubuntu), which means an Ubuntu source package is the presumed point of contact, but the specific package, affected versions, and attack surface remain unidentified. No public exploit identified at time of analysis, and no evidence of confirmed active exploitation (CISA KEV) is present in the provided data.
RemediationAI
Patch status is unconfirmed in the available data; no fix version, vendor advisory, or upstream commit was provided, so no vendor-released patch can be cited. The immediate action is to pull the authoritative record: retrieve the Ubuntu CVE tracker page for CVE-2026-95287 and the corresponding USN to identify the affected source packages, Ubuntu series, and any fixed package versions, then apply those versions through the normal Ubuntu update path (apt update && apt upgrade, or apt install --only-upgrade <package>) after validating in a staging environment. Where the affected component is internet-facing, consider narrowing exposure of that service at the perimeter until its identity is confirmed, accepting the availability and operational cost that this imposes. Because the vulnerable feature has not been identified, no specific configuration toggle, port block, or endpoint restriction can be recommended without risk of disabling unrelated functionality; substituting generic hardening measures would not be traceable to this CVE. Continue monitoring the Ubuntu CVE tracker and ubuntu-security-announce for a USN and re-run this assessment once description, CVSS, and CWE data become available.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
No technical context can be established from the supplied inputs. The CWE is not provided, so the root-cause class (for example memory corruption, injection, access-control failure, or use-after-free) is unknown, and there is no CVSS vector to reveal the attack vector, privileges required, or user interaction. No CPE strings were returned, so the affected product, upstream library or protocol, and operating-system package cannot be pinned down. The single reliable signal is the reporting source: the Ubuntu security tracker, which typically cross-references a CVE against one or more Ubuntu source packages and the corresponding Ubuntu Security Notice (USN) once an update is issued. Any analysis of the underlying technology, exploitability, and preconditions must therefore begin by retrieving the Ubuntu CVE tracker entry for CVE-2026-95287 and the linked upstream project advisory.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: vendor:ubuntu
Lifecycle Timeline
1DescriptionCVE.org
[Unknown description]
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB