Skip to main content

Ubuntu Linux EUVDEUVD-2026-87329

| CVE-2026-17545 MEDIUM
Improper Handling of Windows Device Names (CWE-67)
2026-09-24 vendor:ubuntu
6.9
CVSS 4.0 · Vendor: vendor:ubuntu
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Insufficient data - obtain vendor advisory
  2. Exploit
    Identify affected package and vector
  3. Impact
    Reassess exploitability

Vulnerability Assessment

Weakness
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Improper handling of Windows device names
Exploitation Conditions

Cannot be determined - the CVE record provides no description, no affected feature or configuration, and no CVSS vector. The sole datum is that the issue was reported via the Ubuntu vendor channel, which does not by itself establish any prerequisite. The affected package, deployment mode, and any required authentication or user interaction must be obtained from the Ubuntu Security Notice for CVE-2026-17545 before exploitation conditions can be stated.

Impact

Risk cannot be meaningfully assessed from the available data. The record for CVE-2026-17545 contains no description, no CVSS base score or vector, and no CWE classification. There is no EPSS probability, no CISA KEV listing, and no POC reference in the input, so exploitation status is: no public exploit identified at time of analysis. The only intelligence signal is the reporting source, 'vendor:ubuntu', which typically indicates an entry in the Ubuntu Security tracker for an open-source or Linux distribution package - but the specific package, attack vector, and impact are all unknown. Because CVSS is entirely absent, I cannot state attack vector, complexity, privilege requirements, or authentication needs. No conclusion about whether this is a genuine priority or a low-real-risk issue can be drawn until the underlying advisory is retrieved. Recommend pulling the Ubuntu Security Notice / CVE tracker page for CVE-2026-17545 to obtain the affected package, CVSS, and fix status before triage.

Exploit ScenarioDerived

No exploit scenario can be constructed because the vulnerability description, affected component, and CVSS vector are all missing. No POC is referenced in the provided data. Retrieve the Ubuntu advisory to determine the actual attack surface.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 25, 2026

The CVE-2026-17545 record is effectively empty: it ships with no description, no CVSS vector, no CWE mapping, and no CPE data, and the only intelligence attached to it is that it was reported through the Ubuntu vendor coordination channel. Because the affected package, the vulnerable component, and the required attacker position are all unknown, the risk to any specific Ubuntu deployment cannot be meaningfully assessed from the available data and no impact statement should be issued yet. No public exploit code has been identified at time of analysis, and no EPSS score, KEV listing, or proof-of-concept reference accompanies the record, so there is currently no signal of exploitation activity. The immediate action is intelligence collection rather than mitigation: retrieve the corresponding Ubuntu Security Notice and CVE tracker entry to learn which package and version range are involved before assigning severity or exposure.

RemediationAI

No vendor-released patch has been identified at time of analysis, because the record contains no fix version, no advisory reference, and no patch status field. The primary remediation path is therefore monitoring and rapid application of the eventual Ubuntu fix: track the Ubuntu CVE tracker page for CVE-2026-17545 and subscribe to ubuntu-security-announce so that the corresponding Ubuntu Security Notice is received as soon as it is published, then apply updates with apt update && apt upgrade (or the equivalent for the affected source package) and reboot or restart the affected service as the notice directs. If unattended-upgrades is not already enabled on the fleet, enabling it for the security pocket materially shortens exposure once the fix lands, at the cost of unexpected service restarts. Because the vulnerable feature, port, or configuration option is unknown, no targeted workaround can be recommended with confidence - inventing one such as disabling a service or blocking a port would risk breaking functionality without evidence that it reduces risk. If the tracker later shows the issue is confined to an optional component, the defensible compensating control is to remove or disable that component on internet-facing hosts until patched, accepting the loss of that functionality as the trade-off. Absent that information, treat the item as an unresolved intelligence gap and re-evaluate immediately once the Ubuntu advisory is available.

Affected VersionsENISA

PHP 8.2.* <8.2.34
PHP 8.3.* <8.3.35
PHP 8.4.* <8.4.26
PHP 8.5.* <8.5.11

Affected Packages

euvd php_8_2 fix: 8.2.34
euvd php_8_3 fix: 8.3.35
euvd php_8_4 fix: 8.4.26
euvd php_8_5 fix: 8.5.11

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 4 packages in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

There is no technical detail to analyse in the CVE record itself. The description field is empty, no CVSS vector is supplied (so neither attack vector, attack complexity, privileges required, nor user interaction can be derived), and no CWE identifier is provided, which means the root-cause class - memory corruption, injection, improper access control, cryptographic weakness, or something else entirely - is unknown. The absence of CPE strings also means the affected package name, upstream project, and version range are not enumerated in the feed data. The sole structured datum is the reporting channel: vendor:ubuntu, indicating the issue was routed through Canonical's security coordination process rather than, for example, a CNVD, GitHub advisory, or third-party research disclosure. That routing alone says nothing about severity, exploitability, or reach - Canonical coordinates both trivial and critical issues through the same channel. Confirming the technology stack requires pulling the Ubuntu CVE tracker page for CVE-2026-17545 (which normally lists the source package, the affected Ubuntu releases, and the fix version) and the matching Ubuntu Security Notice (USN), which will supply the description, the impact classification, and the patched package versions that are missing here.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources

No credit card · 7-day full trial

Severity by source

Vendor (vendor:ubuntu) PRIMARY 6.9 MEDIUM
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:H
SUSE MEDIUM
Red Hat 5.9 MEDIUM

Primary rating from Vendor (vendor:ubuntu).

CVSS VectorVendor: vendor:ubuntu

Attack Vector
Network
Attack Complexity
High
Attack Requirements
Present
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
None
Vulnerable system: Integrity
None
Vulnerable system: Availability
Low
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
High

Lifecycle Timeline

1
Patch available
Sep 25, 2026 - 21:18 EUVD

DescriptionCVE.org

[Unknown description]

Threat Intelligence Overview

EPSS Score
0.3%
Top 77% exploitable
Data Quality
7 sources
Confidence: High

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.3%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

34
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +34
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Module for Legacy 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Web and Scripting 15 SP7 Not-Affected
SUSE Linux Enterprise Server 15 SP7 Not-Affected

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy