EUVD-2026-89141
GHSA-w65j-6355-5rfc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInsufficient data to determine access vector
-
ExploitInsufficient data to determine exploit
-
ImpactInsufficient data to determine impact
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Cannot be determined - the description is absent and no CVSS vector is provided, so no product feature, protocol, configuration setting, authentication level, or deployment mode required for exploitation can be named. Retrieve the corresponding Ubuntu Security Notice and upstream advisory to establish concrete prerequisites and limiting factors. |
| Impact | Risk cannot be meaningfully assessed from the available data. The only intelligence provided is that the CVE was reported by vendor:ubuntu (the Ubuntu Security Team), with no description, no CVSS score or vector, no CWE, no EPSS score, no KEV listing, and no POC reference. Without an attack vector, complexity, or privilege metric, none of the standard prioritization signals (CVSS, EPSS, SSVC exploitation/automatable/technical-impact) can be evaluated or cross-referenced. The Ubuntu origin suggests this tracks a vulnerability in a package shipped in the Ubuntu distribution (open-source software), but the specific affected component, impact, and exploitability are all unknown. This should be treated as an UNTRIAGED entry pending retrieval of the upstream description and CVSS data - it cannot be confirmed as either a genuine priority or a low-real-risk issue at this time. |
| Exploit ScenarioDerived | No exploit scenario can be constructed because the vulnerability description, affected component, and impact are entirely absent from the provided data. No POC is referenced in the input. Retrieve the Ubuntu Security Notice / upstream advisory to determine the actual attack surface. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
CVE-2026-95289 is an Ubuntu-tracked security issue whose impact on Ubuntu systems cannot currently be characterized, because no description, CVSS vector, CVSS score, or CWE classification accompanies the record. The only confirmed attribute is provenance: the entry was reported through the Ubuntu vendor channel, which means an Ubuntu Security Notice and a corresponding upstream advisory should exist but were not supplied in the available intelligence. No affected versions, CPE identifiers, references, EPSS score, or KEV status are present, so this analysis cannot state who is exposed, what an attacker gains, or whether exploitation is practical; no public exploit identified at time of analysis, and patch status is likewise undetermined. Per the independent assessment, risk cannot be meaningfully assessed from the available data, and teams should treat this as an unenriched record pending retrieval of the authoritative Ubuntu advisory.
RemediationAI
No vendor-released patch identified at time of analysis, because neither a fixed version nor an advisory reference was included in the available data; consequently no upgrade target can be recommended and no version number should be assumed. The immediate action is enrichment rather than mitigation: locate the Ubuntu Security Notice for this CVE via ubuntu.com/security/notices or the Ubuntu CVE tracker (ubuntu.com/security/CVE-2026-95289), and the upstream advisory it derives from, and use those documents to identify the affected package, releases, and fixed version. Operational hygiene that applies while the record is unresolved includes running 'apt update && apt list --upgradable' plus 'ubuntu-security-status' or 'pro fix CVE-2026-95289' to confirm whether a candidate fix is already published for the installed release, enabling unattended-upgrades for the security pocket so the fix is applied automatically once released, and subscribing to Ubuntu security announcements so the notice is received on publication. No specific compensating control can be recommended at this time, because the vulnerable component, protocol, port, or endpoint is unknown; hardening choices such as disabling a feature or restricting network access cannot be scoped to an unidentified component, and applying generic restrictions would impose availability costs without a demonstrated reduction in exposure. If the issue is later confirmed to be remotely reachable, temporary containment would be considered only after the affected service is identified.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
There is insufficient technical material to explain the underlying technology, library, or protocol involved. The record contains no CWE, so the root-cause class (for example memory corruption, injection, deserialization, race condition, or improper access control) cannot be named, and no CVSS vector is present, so the attack vector, privileges required, and user-interaction requirements are unknown. No CPE strings were provided, so the precise affected product, version range, and deployment footprint within the Ubuntu ecosystem (main archive package, universe package, snap, or Ubuntu-maintained fork of an upstream project) cannot be identified. Ubuntu security entries are typically downstream assignments that mirror an upstream CVE and are published alongside a Ubuntu Security Notice enumerating affected releases, package names, and fixed versions; recovering that notice and the upstream advisory is the prerequisite for any meaningful technical analysis. Because the record is unenriched, no inference about exploitable code paths should be drawn from its existence alone.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: vendor:ubuntu
DescriptionCVE.org
[Unknown description]
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB