Skip to main content

Ubuntu Linux CVE-2026-96280

| EUVDEUVD-2026-88015 HIGH
Numeric Truncation Error (CWE-197)
2026-09-23 vendor:ubuntu
Information Disclosure
7.5
CVSS 3.1 · Vendor: vendor:ubuntu
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Unknown affected product
  2. Exploit
    Vulnerability class not disclosed
  3. Impact
    Impact cannot be determined

Vulnerability Assessment

Weakness
CWE
CWE-197
ASVS 5.0
V15 - Secure Coding and Architecture Numeric truncation prevention
Exploitation Conditions

Cannot be determined. The record provides no product, feature, protocol, configuration setting, or deployment mode, and no CVSS vector from which to derive attack vector, privilege, or user-interaction prerequisites. The description ('security update') states no conditions, and no affected-product identity is available to infer defaults. Exploitation prerequisites and limiting factors are entirely unknown pending vendor/NVD enrichment.
Impact

Risk cannot be meaningfully assessed from the provided data. There is no CVSS vector (so attack vector, complexity, and privilege requirements are all unknown), no EPSS probability, no CISA KEV listing, no POC indicator, and no SSVC inputs. The description is only the placeholder phrase 'security update', which conveys neither the vulnerability class nor the affected product. The sole non-empty signal is that the record was reported by vendor:ubuntu, which indicates Ubuntu tracks a related security update but does not by itself identify the component, severity, or exploitability. Because no severity or exploitation signal is present, this cannot be triaged as either a genuine priority or a high-CVSS-but-low-real-risk issue - it is simply unanalyzable at this time. This is a data-completeness problem, not a finding: any severity claim would be fabricated. Recommendation: wait for NVD/vendor enrichment (product, CVSS, CWE, references) before triage.
Exploit ScenarioDerived

No exploit scenario can be constructed because neither the affected product nor the vulnerability class is known. No public exploit is identified in the provided data, and the CVSS attack vector and complexity are absent, so no realistic attack narrative can be grounded in the input.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
No patch listed yet 0.6% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 24, 2026

Ubuntu package maintainers have published a security update tracked as CVE-2026-96280, reported through the vendor:ubuntu intelligence feed. The advisory is described only by the placeholder text 'security update', and the input provides no CVSS score or vector, no CWE classification, no CPE identifiers, no affected version ranges, and no reference URLs, so the specific package, component, and deployment mode in scope cannot be identified. Whether the issue is remotely or locally triggerable, what privilege level an attacker requires, and what the resulting impact would be are all undetermined; no public exploit code has been identified and there is no CISA KEV designation or EPSS score to indicate active exploitation, therefore risk cannot be meaningfully assessed from the provided data and should be treated as unquantified pending NVD or Ubuntu Security Notice enrichment.

RemediationAI

Because the record lacks any patch reference, fixed version string, package name, or advisory URL, the status must be stated precisely: no vendor-released patch version can be identified from the provided data, even though the record's own label of 'security update' implies Ubuntu has published or intends to publish updated packages through its security pocket. The practical first step is therefore to resolve the advisory itself - look up CVE-2026-96280 on ubuntu.com/security/CVE-2026-96280 and in the Ubuntu Security Notices feed to obtain the affected package, the fixed version, and the applicable release series - and only then apply the specific upgrade named there rather than a guessed one. In the interim, administrators can reduce unquantified exposure by enabling unattended-upgrades for the security pocket ('/etc/apt/apt.conf.d/50unattended-upgrades', ensuring '${distro_id}:${distro_codename}-security' is enabled), refreshing package metadata and applying all currently pending security updates with 'apt update && apt upgrade' or 'apt list --upgradable' followed by 'ubuntu-security-status' to enumerate outstanding CVEs, with the trade-off that blanket upgrades of unrelated packages can introduce regressions and require a maintenance window and reboot for kernel or glibc-class components. If the eventual advisory points to a service or daemon, the natural compensating control is to restrict network reachability to that service via firewall or reverse-proxy rules until the patched package is deployed - the trade-off being loss of functionality for legitimate remote users - but such decisions cannot be finalized until the affected component is identified, and generic hardening advice is the only defensible guidance available at this time.

Affected ProductsAI

The input supplies no product identity beyond the reporting source vendor:ubuntu, and contains no CPE strings and no version ranges. Since Ubuntu's CVE feed covers the base operating system, the kernel, and the full package archive across supported releases, the affected component cannot be narrowed to a single product from the data provided; the only defensible statement is that some Ubuntu-maintained package or system component is the subject of a pending security update. No vendor advisory URL, USN identifier, or reference link was included to resolve the package name or the impacted Ubuntu release series (such as an LTS codename or interim release). Anyone with a concrete deployment should consult the Ubuntu Security Notices portal and the CVE tracker at ubuntu.com/security for the authoritative mapping of CVE-2026-96280 to package and version, since that mapping is absent from this record.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

No technical detail is available for this record. The underlying technology stack is not identified: there is no CPE string naming an operating system component, kernel subsystem, package, or library, and no CWE mapping to characterize the root-cause class (for example memory corruption, authentication bypass, path traversal, or privilege management). The only attributable metadata is the reporting source, vendor:ubuntu, which indicates the entry originated from Ubuntu's security tracking rather than from a CNA-authored advisory with full technical content. The description field contains only the generic placeholder 'security update', which is typically used for records whose detail is published separately in the distribution's own notice feed (Ubuntu Security Notices) rather than restated in the CVE record. Because the affected subsystem, the attack surface it exposes, and the memory-safety or logic-error class are all unknown, no inference about exploitability mechanics - such as whether a crafted input reaches a parser, whether a setuid or service boundary is crossed, or whether container or host isolation is relevant - can be made from the supplied data without contradicting the independent assessment, which found no product, feature, protocol, configuration setting, or deployment mode to reason from.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (vendor:ubuntu) PRIMARY 7.5 HIGH
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
SUSE HIGH
Red Hat 7.5 MEDIUM

Primary rating from Vendor (vendor:ubuntu).

CVSS VectorVendor: vendor:ubuntu

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVSS changed
Sep 27, 2026 - 21:22 NVD
7.5 (HIGH)

DescriptionCVE.org

security update

Technical POC Analysis

A numeric truncation error (CWE-197 per the CVE record; GHSA-jr92-2v97-wgvc itself lists no CWE).

Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.

Sign in to read

Threat Intelligence Overview

EPSS Score
0.6%
Top 53% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.6%
Patch available No
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: +1
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-197 – Numeric Truncation Error

View all
CVE-2022-42475 CRITICAL POC
9.8
CVE-2025-6965 HIGH POC
7.2
CVE-2020-15202 CRITICAL POC
9.0
CVE-2026-63525 HIGH
7.8
CVE-2024-43639 CRITICAL
9.8
CVE-2026-87529 CRITICAL
9.6
CVE-2026-55142 MEDIUM
5.5
CVE-2026-109588 CRITICAL
9.3

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Module for Desktop Applications 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server 16.0 Affected
SUSE Linux Enterprise Server 16.1 Affected

References

Advisories & patches
ADVISORY https://access.redhat.com/security/cve/CVE-2026-96280 ADVISORY https://bugzilla.redhat.com/show_bug.cgi?id=2539419 ADVISORY https://github.com/flatpak/flatpak/security/advisories/GHSA-jr92-2v97-wgvc ADVISORY https://vuldb.com/vuln/410957 REF https://access.redhat.com/errata/RHSA-2026:80497 REF https://access.redhat.com/errata/RHSA-2026:80498 REF https://access.redhat.com/errata/RHSA-2026:80687

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy