EUVD-2026-86497
GHSA-3rh3-f3vh-mgjh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInsufficient data to construct attack chain
-
ExploitAffected component unknown
-
ImpactRetrieve upstream Ubuntu advisory
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Leading special element handling
|
| Exploitation Conditions | Cannot be determined - the description is empty and no CVSS vector is provided, so the required product feature, configuration, protocol, privilege level, or user interaction are all unknown. The only datum is that Ubuntu is the reporting vendor, which suggests the flaw affects a package distributed in Ubuntu but does not identify which one. Retrieve the associated Ubuntu Security Notice (USN) and the NVD entry to establish concrete prerequisites and limiting factors before making any defensive decision. |
| Impact | Risk cannot be meaningfully assessed from the provided data. The record contains no description, no CVSS score or vector, and no CWE - the only intelligence signal is that it was reported by vendor:ubuntu, suggesting this likely tracks an Ubuntu Security Notice for a packaged component, but the affected package and vulnerability class are unknown. There is no EPSS score, no CISA KEV listing, and no POC indicator provided, so per available data this is 'no public exploit identified at time of analysis.' No signals conflict because effectively only one metadata field exists; however, the complete absence of a description and CVSS vector means severity, attack vector, privilege requirements, and impact are all UNKNOWN and must not be inferred. Priority cannot be established - this record must be enriched from the upstream Ubuntu advisory (USN) and NVD before any risk decision. Do not treat the empty fields as 'low risk'; treat them as unassessed. |
| Exploit ScenarioDerived | No exploit scenario can be constructed because the vulnerability description, affected component, and vulnerability class are all absent from the provided data. No POC or active exploitation is indicated in the input. Consult the corresponding Ubuntu Security Notice to determine the affected package and attack surface. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 25, 2026
The security impact of CVE-2026-95811 cannot be established from the available intelligence: the record carries no description, no CVSS score or vector, and no CWE classification, and the only confirmed signal is that Ubuntu is the reporting vendor, which indicates a flaw in a package distributed through Ubuntu rather than identifying which package. Because the affected component, attack surface, and prerequisites are all unknown, no defensible claim about confidentiality, integrity, or availability impact can be made, and no public exploit code or CISA KEV entry has been identified at time of analysis. This should be treated as an intelligence gap to close - retrieve the associated Ubuntu Security Notice (USN) and the NVD entry - rather than as a basis for a triage or risk-acceptance decision.
RemediationAI
No patch data is included in this record, so no vendor-released patch or fix version can be cited; patch status is 'No vendor-released patch identified at time of analysis' strictly because the information is absent, not because a fix is known to be missing. Because the vulnerable feature is unidentified, no targeted workaround such as disabling a specific option, blocking a port, or restricting an endpoint can be responsibly recommended - inventing one would create false assurance. The actionable steps are procedural and verifiable: locate the USN for CVE-2026-95811 through the Ubuntu Security Notices index on ubuntu.com and Ubuntu's CVE tracker, then apply the referenced package versions; on the fleet side, confirm the security pocket is enabled and unattended-upgrades is active for it (or use Livepatch where applicable), and audit current exposure with 'pro security-status' (Ubuntu Pro) or 'ubuntu-security-status' on older releases. The trade-offs are real: unattended security upgrades can restart services, reload databases, or trigger kernel reboots requiring a maintenance window, and if the ultimately affected package sits in the universe component it receives community rather than Canonical-supported maintenance, so fixes may lag and may require pulling the patched version from a newer Ubuntu release. Delaying any action until the CVE details are read is preferable to applying speculative mitigations, but do triage the USN promptly once published, since an Ubuntu-authored CVE with no public details can still resolve into a high-impact issue.
Affected ProductsAI
The affected product cannot be identified at the package level from the supplied data. The only verified attribution is Ubuntu as the reporting vendor, which implies that some package shipped in the Ubuntu archive is affected, but no package name, version range, Ubuntu release, or CPE string is provided. There are no vendor advisory URLs or patch references in the input to cite. To establish affected products, consult Ubuntu's CVE tracker for CVE-2026-95811 at the standard /security/CVE-2026-95811 path on ubuntu.com, the Ubuntu Security Notices index at ubuntu.com/security/notices, and the NVD entry once it is populated, then map the resulting package name to concrete versions per release using apt-cache policy or the Ubuntu package pages. Until that lookup is done, any statement naming a specific package or version would be speculation.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The entry is essentially empty from a technical standpoint: no CWE is assigned, so the root-cause class (memory corruption, injection, access-control failure, cryptographic weakness, and so on) is entirely undetermined, and no CVSS vector is present, so neither the attack vector (network, adjacent, local, physical) nor the privilege and user-interaction prerequisites are known. The sole metadata point is the attribution 'vendor:ubuntu', which in CVE practice typically means the report was routed through or triaged by Ubuntu's security team and usually coincides with a package maintained in the Ubuntu archive, most often published alongside an Ubuntu Security Notice covering one or more Ubuntu releases (for example jammy, noble, or plucky) and their corresponding binary and source package versions. Ubuntu is a Debian-derived distribution, so an affected package would normally also have an upstream project and a Debian counterpart, and fixes may propagate from Debian or from the upstream maintainer. Without a CPE string, package name, or version range, none of that can be pinned down, and the correct next step is to query Ubuntu's CVE tracker (which uses the /security/CVE-<id> convention) and the NVD entry for CVE-2026-95811 and to read the referenced USN in full.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Primary rating from Vendor (vendor:ubuntu) · only source for this CVE.
CVSS VectorVendor: vendor:ubuntu
Lifecycle Timeline
1DescriptionCVE.org
[Unknown description]
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB