EUVD-2026-112299
GHSA-4hx4-q2mp-7h24
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttack vector unknown
-
ExploitMechanism not described in sources
-
ImpactImpact undetermined
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Algorithmic complexity limits
|
| Exploitation Conditions | Exploitation prerequisites cannot be determined - the description is empty and no CVSS vector (AV/AC/PR/UI) is provided, so required configuration, feature state, authentication level, user interaction, and affected deployment modes are all unknown. The trigger is not described in the available sources. The only limiting context is that the issue is tracked by Ubuntu, implying it affects a package within the Ubuntu ecosystem, but the specific package, enabling conditions, and any non-default requirements are not stated. |
| Impact | Risk cannot be meaningfully quantified from the supplied data. No CVSS vector, CVSS score, CWE, EPSS probability, KEV status, or POC indicator was provided, and the description is empty, so attack vector, complexity, privilege requirements, and technical impact are all unknown. The only concrete prioritization signal is the vuln.today Decision label 'this_month', which indicates moderate (non-emergency, non-act_now) urgency rather than immediate action; there is no KEV confirmation of active exploitation and no EPSS score to gauge exploitation probability. The sole sourcing is a vendor:ubuntu report, suggesting this is tracked as a package/distribution-level issue in Ubuntu, but the affected component, versions, and fix status are not stated. CONFLICT/GAP TO VERIFY: a 'this_month' priority with no CVSS, no description, and no exploitation evidence most likely reflects an incompletely populated advisory rather than a validated high-risk flaw - treat severity as indeterminate and re-assess once Ubuntu's USN/CVE record and NVD enrichment are available. |
| Exploit ScenarioDerived | No realistic attack scenario can be constructed because the vulnerability description, affected component, and attack vector are not provided in the available data. No public exploit is identified at time of analysis. Any scenario offered here would be unsupported speculation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
CVE-2026-116267 is a flaw tracked in the Ubuntu ecosystem for which the available intelligence contains no description, no CWE classification, no CVSS score or vector, and no identified package or version range. Because severity, trigger conditions, and authentication requirements are all unrecorded, the practical impact on any given Ubuntu deployment cannot be scoped from the supplied data, and risk cannot be meaningfully quantified. There is no KEV listing and no public exploit identified at time of analysis; the vuln.today priority label places it in the 'this_month' remediation bucket rather than an immediate-action tier.
RemediationAI
No vendor-released patch version is identified in the supplied data, and no fixed release can be cited. The primary action is to monitor the Ubuntu CVE tracker and Ubuntu Security Notice feed for CVE-2026-116267 and apply the corresponding USN package update for each affected release as soon as it is published; because the package is not named in the available data, the update cannot yet be pinned to a specific version or pocket. Because the affected component, the enabling configuration, and the trigger are all unknown, no specific compensating control - such as disabling a named feature, blocking a particular port, or restricting access to a defined endpoint - can be recommended on the evidence available, and any such advice would be guesswork rather than a targeted mitigation. Where the flaw ultimately turns out to sit in a service that is not required on a given host, removing or masking that package would reduce exposure, with the trade-off that doing so may break dependent workloads; this can only be evaluated after the affected package is identified.
Affected ProductsAI
The affected product set is not enumerated in the supplied data. The record is attributed to the Ubuntu vendor source, which implies one or more packages distributed in the Ubuntu archive are affected, but no package name, no Ubuntu release, no version range, and no CPE string is provided, so the precise affected products cannot be listed. No vendor advisory URL or Ubuntu Security Notice identifier for this CVE was included in the available references. The authoritative affected-package detail should be taken from the Ubuntu CVE tracker entry for CVE-2026-116267 once it is populated.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
No CWE is assigned in the available data, so the root-cause class (memory safety, injection, logic error, race condition, or other) cannot be determined, and the trigger is not described in the available sources. The only substantive technical signal is provenance: the record is reported by the Ubuntu vendor channel, which indicates the vulnerable component ships as a package maintained within the Ubuntu archive rather than as a standalone upstream product - but the specific package, the affected release(s), the subsystem involved, and whether the flaw is reachable over the network, requires local access, or depends on a non-default configuration are all unstated. No CPE identifiers were provided to anchor the affected product set, and the missing CVSS vector means AV, AC, PR, and UI cannot be derived, so authentication requirements are not confirmed from available data and user interaction requirements are unknown. Any assumption about exploitation prerequisites for this record would be speculation rather than analysis.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
DescriptionCVE.org
[Unknown description]
Threat Intelligence Overview
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB