EUVD-2026-89254
GHSA-pp8f-g8qm-wq9m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInsufficient data
-
ExploitNo description or CVSS vector
-
ImpactAttack chain undetermined
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Cannot be determined - the source provides no description, no affected feature or configuration, and no CVSS vector, so no concrete prerequisites, authentication level, user-interaction, or configuration dependencies can be extracted. Awaiting published description and CVSS data from NVD/Ubuntu Security before any exploitation conditions can be stated. |
| Impact | Risk cannot be meaningfully assessed from the provided data. There is no description, no CVSS base score or vector, no CWE, no EPSS probability, no CISA KEV status, no POC indicator, and no SSVC decision data. The only signal is that the record was reported/tracked by the Ubuntu vendor feed, which indicates a Linux-distribution-relevant package but does not identify the product, attack vector, complexity, or privilege requirement. Because no exploitation-probability or impact signals exist, this cannot be classified as either a confirmed priority or a high-CVSS-but-low-real-risk issue - it is currently unscored and unclassifiable. No public exploit identified at time of analysis. All severity, vector, and impact fields must be treated as UNKNOWN pending publication of the description and CVSS data by NVD or Ubuntu Security. |
| Exploit ScenarioDerived | No exploit scenario can be constructed because the vulnerability description, affected component, and attack vector are all absent from the source data. No POC is referenced. Any scenario would be pure speculation and is therefore withheld. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
CVE-2026-95302 is an identifier tracked by the Ubuntu security team, but at the time of analysis no description, CWE classification, CVSS score, or CVSS vector has been published for it, so the affected component, the attack surface, and the resulting impact are all undetermined. Because there is no affected feature or configuration documented, no exploitation prerequisites, authentication level, or user-interaction requirement can be stated. There is no evidence of active exploitation (not listed in CISA KEV) and no public exploit identified at time of analysis; risk cannot be meaningfully assessed from the provided data.
RemediationAI
No vendor-released patch or fix version can be confirmed from the available data, and no advisory URL was supplied, so no upgrade target can be named. Because the affected package and flaw class are unknown, no specific compensating control can be recommended with confidence - measures such as disabling a feature, blocking a port, or restricting endpoint access would have to be guesswork and could impose availability costs for no measurable security benefit. The actionable step is monitoring: follow the Ubuntu security CVE tracker and USN feed for CVE-2026-95302, subscribe to NVD for the eventual CVE record, and keep Ubuntu systems on supported releases with unattended-upgrades enabled so that any published fix is applied promptly. If the CVE later resolves to an installed package, apply the exact version listed in the corresponding USN rather than a general system upgrade, and re-run this assessment once the description, CWE, and CVSS vector are available.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The only intelligence available is a single source attribution of 'vendor:ubuntu', which indicates the CVE is being tracked in Ubuntu's security database rather than that Ubuntu is necessarily the upstream project. No CWE is supplied, so the root-cause class - whether memory corruption, injection, access-control failure, or something else - cannot be characterized, and no CPE strings are provided to pin the vulnerability to a specific package, library, kernel subsystem, or protocol implementation. Without a CVSS vector, there is also no information about attack vector, privileges required, or scope change to reason about. Any technical characterization at this point would be speculation; the assessment should be revisited once NVD or the Ubuntu Security Notices (USN) database publishes a description, CWE, and CVSS metrics.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Primary rating from Vendor (vendor:ubuntu) · only source for this CVE.
CVSS VectorVendor: vendor:ubuntu
DescriptionCVE.org
[Unknown description]
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB