Linux Foundation Magma EUVD-2026-68266

The Magma mobile core's control plane interface (S1-MME or equivalent AGW endpoint processing NAS messages) must be network-reachable by the attacker. No authentication is required per the CVSS PR:N metric. No non-default configuration is required - the SecurityModeComplete Handler is part of standard LTE security negotiation and is active in default Magma deployments. Exploitation is limited by network topology: in production deployments, the core control plane should be accessible only to trusted RAN elements via private network segments; if this segmentation is in place, external attackers cannot reach the vulnerable handler. Attack complexity is low and no user interaction is needed, meaning exploitation is straightforward once network reachability is established. The subsequent-system impact indicators in the CVSS 4.0 vector (SC:L/SI:L/SA:L) suggest that bypass of integrity verification can have downstream effects on connected network components.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms network-reachable exploitation with no complexity, privilege, or interaction requirements - the most accessible attack profile. Impact across vulnerable and subsequent systems is uniformly Low (VC:L/VI:L/VA:L/SC:L/SI:L/SA:L), reflecting a bypass of security negotiation rather than direct data exfiltration or denial of service. The E:P modifier confirms a public proof-of-concept exists on GitHub, elevating exploitation likelihood above baseline. No CISA KEV listing is present, so active exploitation is not confirmed. EPSS data is absent from the provided intelligence. No CVSS 3.1 vector is provided; the 3.1 assessment is independently derived below. The real-world priority is moderate: the attack requires network reachability to Magma's control plane interfaces, which in well-segmented deployments limits exposure significantly. However, in any deployment where the AGW or MME is reachable from untrusted network segments, the combination of no-auth exploitation and a public POC warrants prompt attention.

An attacker with network access to a Magma deployment's mobile core control plane crafts a SecurityModeComplete NAS message with an absent or incorrect integrity check value. Because the handler fails to validate this integrity field per CWE-354, the message is accepted as legitimate, allowing the attacker to bypass NAS security mode enforcement - potentially enabling injection or replay of subsequent NAS signaling without detection. A proof-of-concept demonstrating this bypass is publicly available via the GitHub issue tracker at https://github.com/magma/magma/issues/16024.