EUVD-2026-89263
GHSA-4p97-5r6h-37wj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessUnknown access vector
-
ExploitUnknown vulnerability
-
ImpactUnknown impact
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Cannot be determined - the description is empty and no CVSS vector, product, feature, protocol, configuration, or deployment-mode information is provided. No prerequisites or limiting factors can be extracted from the available data. |
| Impact | Risk cannot be meaningfully assessed from the available data. The entry provides no description, no CVSS score, no CVSS vector, no CWE, and no references - the only signal is that it was 'reported by vendor:ubuntu'. There is no EPSS score, no CISA KEV listing, and no public POC indicated. With no attack vector, complexity, or privilege data, none of the standard prioritization signals (CVSS, EPSS, SSVC, KEV) can be evaluated or cross-referenced. This CVE is neither confirmable as high-risk nor dismissable as low-risk - it is simply unanalyzable at this time. The affected product is UNKNOWN; while this identifier sits numerically below a batch of Google Chrome CVEs (CVE-2026-95344 through 95357) published in the same period, that adjacency is NOT sufficient to confirm it is a Chrome issue, and no product attribution should be asserted. Treat as a placeholder pending vendor/NVD enrichment. |
| Exploit ScenarioDerived | No exploit scenario can be constructed because the vulnerability description, affected product, and attack vector are all unknown. No public exploit has been identified for this identifier. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Risk for CVE-2026-95317 cannot be meaningfully assessed from the available data, and no impact statement should be relied upon until a description, CVSS vector, or affected component is published. The only intelligence associated with this identifier is a vendor attribution to Ubuntu; there is no description text, no CVSS score or vector, no CWE classification, no CPE data, and no reference set that would identify the vulnerable product, feature, protocol, or deployment mode. Exploitation status is likewise indeterminate: no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was provided to quantify likelihood. Treat this record as unresolved rather than benign - the absence of detail reflects missing publication data, not a confirmed low-severity finding.
RemediationAI
No vendor-released patch identified at time of analysis, and no fix version can be cited because the input contains no patch data, no advisory reference, and no indication of the affected package. The realistic first action is intelligence gathering rather than mitigation: subscribe to the ubuntu-security-announce mailing list and watch the Ubuntu CVE tracker page for CVE-2026-95317, so that the package name, affected release versions, and fixed version are picked up the moment they are published. Because the vulnerable component, feature, protocol, and deployment mode are all unknown, no specific compensating control can be recommended without risking wasted effort or a false sense of coverage - disabling services, blocking ports, or restricting endpoints at random would impose operational cost with no demonstrable risk reduction for this identifier. If the organisation requires interim action before details emerge, the defensible options are limited to generic hygiene that carries no significant side effects: keep Ubuntu package inventories current and auditable so a targeted upgrade can be executed quickly once the fixed version lands, ensure unattended-upgrades or an equivalent patch pipeline is functioning, and preserve sufficient logging to retro-hunt if exploitation guidance later points to a detectable behaviour. Re-assess and replace this remediation once a USN or NVD entry supplies the exact fix version and the precise vulnerable component.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
No technical characterisation is possible. The record supplies no CWE identifier, so the root-cause class (for example memory corruption, injection, authorization bypass, or deserialization) is unknown, and no CPE strings are present to anchor the vulnerability to a specific package, library, or protocol implementation. The sole signal is a 'vendor:ubuntu' attribution, which indicates that Ubuntu's security team is the source of or assigner for this identifier and that the affected artifact is plausibly one of the packages shipped in Ubuntu repositories - but attribution of a CVE to a vendor source does not establish the impacted upstream project, the reachable code path, or the attack surface. Standard Ubuntu advisories tie CVEs to specific source packages and binary package versions; none of that mapping exists here. Any attempt to infer the technology stack, the preconditions for exploitation, or the privilege level required (PR:N versus PR:L/PR:H) would be speculation, and the authoritative assessment explicitly states that no prerequisites or limiting factors can be extracted from this data set.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Primary rating from Vendor (vendor:ubuntu) · only source for this CVE.
CVSS VectorVendor: vendor:ubuntu
DescriptionCVE.org
[Unknown description]
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB