EUVD-2026-89137
GHSA-xm9r-fq4j-g8hq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInsufficient data to construct attack chain
-
ExploitProduct and vector unknown
-
ImpactImpact undetermined
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V3 - Web Frontend Security UI security representation
|
| Exploitation Conditions | Cannot be determined. The description is empty ('[Unknown description]') and no CVSS vector is provided, so no product feature, protocol, configuration setting, deployment mode, authentication level, or user-interaction requirement can be identified. No limiting factors can be stated. Defenders should treat this as an unenriched placeholder record and re-evaluate once NVD or the vendor publishes a description and CVSS metrics. |
| Impact | Risk cannot be meaningfully assessed from the available data. The input is a data-void entry: description is '[Unknown description]', CVSS score and vector are N/A, and CWE is N/A. There is no EPSS probability, no CISA KEV listing, no POC indicator, and no SSVC decision data. The only signal present is 'Reported by: vendor:ubuntu', which indicates the record was surfaced through Ubuntu's tracker but conveys nothing about attack vector, complexity, privileges, or impact. With no CVSS vector, authentication and exploitability requirements are entirely unknown and MUST NOT be inferred. Exploitation status is 'no public exploit identified at time of analysis'. This is neither a confirmed high-priority issue nor a confirmed low-risk one - it is simply unanalyzable until NVD/vendor enrichment provides a description and scoring. Numerically it sits just below the CVE-2026-95344 through CVE-2026-95357 batch that is confirmed to be Google Chrome stable-channel fixes, but proximity in ID space is NOT evidence of the same product; this ID is NOT confirmably Chrome and no product attribution should be asserted. |
| Exploit ScenarioDerived | No exploit scenario can be constructed because the vulnerability description, affected product, and CVSS vector are all absent. No public proof-of-concept is referenced. Any scenario would be pure speculation and is therefore withheld pending enrichment. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Risk cannot be meaningfully assessed for CVE-2026-95323 because the record contains no description, no CVSS score or vector, no CWE mapping, and no affected-product identifiers, leaving a vendor attribution to Ubuntu as the only intelligence available. With no information about the vulnerable component, its deployment mode, or the attacker's required position, no impact statement, authentication requirement, or exploitation precondition can be derived. There is no public exploit identified at time of analysis, and this should be handled as an unenriched placeholder record that is re-evaluated once NVD or the Ubuntu security team publishes a description and severity metrics.
RemediationAI
Patch status is unknown: no vendor-released patch, fixed version, or upstream commit is identified in the available data, and the absence of patch information is not confirmation that no fix exists. The first actionable step is enrichment rather than mitigation - monitor the NVD record, the Ubuntu CVE tracker page at ubuntu.com/security/CVE-2026-95323, and Ubuntu Security Notices for the matching advisory, and route the identifier to whoever owns Ubuntu fleet patching so the relevant source package can be identified the moment a description or CPE appears. If a package is later confirmed affected, the standard compensating controls and their trade-offs apply: restrict network exposure of the affected service to trusted management networks (reduces reachable attack surface but can break legitimate remote clients and integrations), disable the vulnerable feature or module if the advisory identifies one (eliminates the exposure path but may remove functionality other components depend on), and where the issue is only reachable by local or low-privileged users, tighten local account and sudo policy (limits the blast radius but adds operational friction). Until a description and severity are published, no specific upgrade or configuration change can be recommended with confidence, and treating this record as an active threat would not be supported by the available evidence.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The underlying technology, library, or protocol at risk cannot be identified from the supplied data: there are no CPE strings, no CWE identifier, and no CVSS vector, so even the weakness class (memory corruption, injection, access control, cryptographic handling, and so on) cannot be inferred or taught against. The single substantive data point is the reporting source, 'vendor:ubuntu', which indicates the record was routed through Ubuntu's security process and most plausibly relates to a package maintained in the Ubuntu archive rather than to an upstream project authoritative for the CVE; that is an attribution signal, not confirmed product evidence. Ubuntu acts as the CNA for many issues in its own packages and typically publishes correlated advisories (USNs) alongside its CVE tracker entries, so the natural next enrichment steps are the NVD record and the Ubuntu CVE tracker page for this identifier. Until one of those sources supplies a description, CPE, and vector, any technical characterization - including which subsystem is touched or whether the bug is pre- or post-authentication - would be speculation and is deliberately omitted here.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: vendor:ubuntu
Lifecycle Timeline
1DescriptionCVE.org
[Unknown description]
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB