EUVD-2026-89245
GHSA-vphq-f86f-m2fj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessUnknown affected product
-
ExploitUnknown vulnerability class
-
ImpactImpact undetermined
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Cannot be determined. The description is empty and no CVSS vector, product feature, protocol, configuration setting, or deployment mode is specified in the available data. Retrieve the upstream Ubuntu/NVD advisory to establish prerequisites and limiting factors before any defensive decision is made. |
| Impact | Risk cannot be meaningfully assessed from the available data. The only signal present is that the CVE was reported/tracked by vendor:ubuntu (the Ubuntu security tracker); there is no description, no CVSS base score or vector, no CWE, no EPSS probability, no CISA KEV listing, no SSVC decision point, and no POC. With every primary prioritization signal absent, it is impossible to distinguish a genuine priority from a low-real-risk issue. No attack vector, complexity, privilege, or impact metric is available to reason about. This entry should be treated as an unresolved placeholder pending an authoritative description from the upstream vendor or NVD, and it should NOT be scored or prioritized until the source advisory is retrieved. Exploitation status: no public exploit identified at time of analysis. |
| Exploit ScenarioDerived | No realistic attack scenario can be constructed because the affected product, vulnerability class, and attack vector are all unknown. No POC is referenced in the provided data. Any scenario written now would be fabrication rather than analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Risk cannot be meaningfully assessed for CVE-2026-95299 because the vulnerability record contains no description, no CVSS score or vector, no CWE mapping, and no CPE/product identifiers; the only attributable data point is that the issue was reported by the vendor Ubuntu. Consequently the affected component, the attack surface, and any prerequisite conditions remain unknown, and no public exploit has been identified at time of analysis. Analysts should treat this identifier as unresolved rather than low-risk: an empty record frequently reflects a placeholder or embargoed entry that is populated later, so the absence of detail is not evidence of low severity.
RemediationAI
No vendor-released patch has been identified at time of analysis, and it must be stressed that the absence of patch data is not confirmation that no fix exists - it reflects an incomplete vulnerability record. Until the advisory is retrieved, the actionable step is intelligence resolution rather than mitigation: pull the Ubuntu CVE tracker page for CVE-2026-95299 (https://ubuntu.com/security/CVE-2026-95299), the corresponding NVD entry, and any published USN to determine the affected package, version range, and fixed version, then apply the Ubuntu-provided package update exactly as specified in that advisory. If, after retrieval, no fixed package is available, compensating controls cannot be prescribed responsibly at this stage because the attack vector is unknown; any interim measure such as restricting network exposure, disabling a specific service, or applying AppArmor confinement would be guesswork and carries the side effect of potentially unnecessary service disruption. Escalate to the Ubuntu security team or the distributing vendor if the record remains empty, and re-run this assessment once the advisory, CVSS vector, and CWE are populated.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
There is insufficient technical data to describe the underlying technology, library, or protocol involved. No CWE is supplied, so the root-cause class (for example memory corruption, injection, improper authorization, or deserialization) cannot be inferred, and the lack of CPE strings means no exact affected product or version range can be enumerated. The single signal available is the reporting attribution to Ubuntu, which suggests - but does not confirm - that the issue affects a package maintained in the Ubuntu archive or an Ubuntu-specific component or kernel backport, and that a Ubuntu Security Notice (USN) or Ubuntu CVE tracker entry may exist or may be pending. Any claim about authentication requirements, exploitability complexity, or impact at this point would be speculation; per the independent assessment, prerequisites and limiting factors cannot be determined until the upstream Ubuntu/NVD advisory is retrieved.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Primary rating from Vendor (vendor:ubuntu).
CVSS VectorVendor: vendor:ubuntu
DescriptionCVE.org
[Unknown description]
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Same weakness CWE-416 – Use After Free
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB