Is there a public PoC exploit available for EUVD-2026-26699?

Yes, a public proof-of-concept exploit is available for EUVD-2026-26699. Prioritise patching immediately. EPSS: 0.0%.

Open5GS EUVD-2026-26699

Q: What is the CVSS score of EUVD-2026-26699?

EUVD-2026-26699 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-7587 LOW

Improper Resource Shutdown or Release (CWE-404)

2026-05-01 VulDB

Denial Of Service Open5gs

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

PoC Detected

May 01, 2026 - 20:22 vuln.today

Public exploit code

Analysis Generated

May 01, 2026 - 17:33 vuln.today

Severity Changed

May 01, 2026 - 17:22 NVD

MEDIUM LOW

CVSS changed

May 01, 2026 - 17:22 NVD

4.3 (MEDIUM) 2.1 (LOW)

EUVD ID Assigned

May 01, 2026 - 17:00 euvd

EUVD-2026-26699

Analysis Generated

May 01, 2026 - 17:00 vuln.today

CVE Published

May 01, 2026 - 16:45 nvd

LOW 2.1

DescriptionCVE.org

A vulnerability has been found in Open5GS up to 2.7.7. This vulnerability affects the function amf_nsmf_pdusession_handle_update_sm_context of the file /src/amf/nsmf-handler.c of the component AMF. The manipulation leads to denial of service. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Denial of service in Open5GS AMF component up to version 2.7.7 allows authenticated remote attackers to trigger resource exhaustion via improper handling of PDU session context update messages in the amf_nsmf_pdusession_handle_update_sm_context function. The vulnerability has a low CVSS score (2.1) but publicly available exploit code exists; however, exploitation requires prior authentication to the 5G network, significantly limiting real-world attack surface.

Technical ContextAI

Open5GS is an open-source 5G core network implementation. The vulnerability exists in the AMF (Access and Mobility Management Function) component, specifically in the function amf_nsmf_pdusession_handle_update_sm_context located in /src/amf/nsmf-handler.c. This function handles PDU Session Management (NSMF) protocol interactions for session context updates. The root cause is classified as CWE-404 (Improper Resource Validation), indicating the code fails to properly validate or handle resource allocation/deallocation when processing session context update messages. The attack vector is network-based but requires Layer 3 (N1) 5G NAS protocol access or equivalent authenticated connection to the AMF.

RemediationAI

Upgrade to a patched version of Open5GS once available from the upstream project (monitor https://github.com/open5gs/open5gs for releases). If immediate patching is not possible, implement network-level compensating controls: restrict access to the AMF N1 interface to known trusted UE devices via firewall rules or network access control lists, disable unnecessary PDU session management features if operationally feasible (verify with deployment documentation), and implement rate limiting on NSMF protocol messages to mitigate DoS impact. Monitor AMF logs for repeated session context update failures or resource exhaustion patterns, which may indicate exploitation attempts. Note that restricting N1 access may impact legitimate network operations.