EUVD-2026-89119
GHSA-5r8h-23w6-rqxq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessUnknown access vector
-
ExploitUnknown vulnerability trigger
-
ImpactUnknown impact
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Incomplete cleanup
|
| Exploitation Conditions | Cannot be determined - the description is empty and no CVSS vector, product name, feature, protocol, or configuration detail is provided. Neither the prerequisites for exploitation nor the factors that would limit it can be established from the available data. Retrieve the full CVE/NVD record or the corresponding vendor advisory to identify the affected product and the specific conditions required. |
| Impact | Risk cannot be meaningfully assessed from the provided data. There is no description, no CVSS base score or vector, no CWE, no EPSS probability, no KEV listing, no POC reference, no SSVC decision data, and no affected-product identification. The only signal is that the record was surfaced via the Ubuntu security tracker (Reported by: vendor:ubuntu), which mirrors CVEs for many upstream packages and does not by itself indicate severity, exploitability, or exposure. With no attack-vector, complexity, privilege, or impact metrics available, it is impossible to distinguish whether this is a genuine priority or a low-real-risk issue. All key scoring signals are MISSING and must be obtained from the authoritative source (NVD/CVE record or the relevant vendor advisory) before any prioritization decision. Do NOT treat the absence of KEV/EPSS/POC as evidence of low risk - it reflects absent data, not confirmed benignity. |
| Exploit ScenarioDerived | No exploit scenario can be constructed because the vulnerability class, affected product, and attack vector are all unknown. No public exploit code is referenced in the provided data. Any scenario would be pure speculation and is therefore withheld. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Impact cannot be characterized for CVE-2026-95303 because the record supplies no description, no CVSS score or vector, no CWE mapping, and no CPE or version identifiers - the only usable signal is a reporting attribution to the Ubuntu vendor source. Because neither the affected component nor the attack prerequisites are known, no exploitability determination is possible; no public exploit is identified at time of analysis, and this should not be read as evidence that none exists. Treat this entry as unresolved and retrieve the authoritative Ubuntu Security Notice or the upstream NVD record before making any exposure, prioritization, or remediation decision.
RemediationAI
No patch information is present in the supplied data - no fix version, no patch reference, and no vendor statement - so no vendor-released patch could be identified at time of analysis and no upgrade can be recommended by version number without inventing one. The immediate actionable step is disclosure retrieval rather than mitigation: open ubuntu.com/security/CVE-2026-95303 and the corresponding Ubuntu Security Notice (search the notices index at ubuntu.com/security/notices, or run 'ubuntu-security-status' / 'pro security-status' on the host to see whether installed packages are covered) to identify the affected source package and the fixed version. Once the package is known, apply the advisory's fixed version with 'sudo apt update && sudo apt install --only-upgrade <package>' or a full 'sudo apt full-upgrade', and confirm the corrected version with 'apt policy <package>'; where the host relies on Canonical Livepatch or Ubuntu Pro/ESM, verify that the relevant series is still under support, since applying the fix on an out-of-support release may require enabling ESM first (a trade-off of added subscription overhead against receiving the patch at all). Because the vulnerable feature, protocol, port, or endpoint is unknown, no meaningful compensating control can be specified at this time - options such as disabling a service, restricting network access, or tightening a configuration cannot be chosen without knowing which component is affected, and applying speculative controls risks breaking unrelated functionality without reducing real exposure. In the interim, treat the asset as unassessed, avoid exposing unneeded services, and prioritize obtaining the USN over ad hoc hardening.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
There is no technical substrate to describe from the available data. A CWE is not assigned, so the root-cause class - whether memory corruption, injection, improper authorization, deserialization, or a logic error - is entirely unknown. No CPE strings were provided, so the affected product, package, library, protocol, or subsystem cannot be identified even at a coarse level. The single intelligence data point is the reporting source, 'vendor:ubuntu', which indicates the record originates from or is coordinated with Canonical's Ubuntu security process, meaning the authoritative artifact is most likely an Ubuntu Security Notice (USN) mapping one or more binary or source packages across supported Ubuntu releases (including LTS series and, where applicable, Extended Security Maintenance streams) rather than a vendor-specific upstream advisory. The absence of a CVSS vector also means authentication requirements cannot be confirmed from available data - PR:N, PR:L, and PR:H cannot be distinguished. Until the USN or the NVD record is retrieved, any statement about the vulnerable component, the attack surface, or the privilege level required would be speculation rather than analysis.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: vendor:ubuntu
Lifecycle Timeline
1DescriptionCVE.org
[Unknown description]
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Same weakness CWE-459 – Incomplete Cleanup
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB