EUVD-2026-89262
GHSA-xgm6-8mhf-wc45
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessUnknown access vector
-
ExploitUnknown vulnerability trigger
-
ImpactUnknown impact
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Cannot be determined - the description is empty and no CVSS vector, affected product, feature, protocol, or configuration is provided. Exploitation prerequisites and limiting factors are entirely unknown pending publication of the CVE record and the corresponding Ubuntu/upstream advisory. |
| Impact | This CVE cannot be meaningfully risk-assessed because it is a complete data void: the description is '[Unknown description]', no CVSS score or vector is provided, no CWE is assigned, and there is no EPSS score, no CISA KEV listing, no POC, no SSVC decision data, and no references. The only intelligence signal is that it was 'Reported by: vendor:ubuntu', which indicates Ubuntu is tracking it (typically because the CVE affects a package Ubuntu ships) but reveals nothing about the vulnerable component, attack vector, complexity, privileges, or impact. With no CVSS vector, exploitation status is 'no public exploit identified at time of analysis' and authentication requirements cannot be determined. Any severity or exploitability claim here would be fabrication. Treat this as an unanalyzable placeholder pending publication of the description, CVSS vector, and references - do not prioritize or deprioritize on the basis of this record alone; verify directly against the Ubuntu Security Notice / upstream advisory once populated. |
| Exploit ScenarioDerived | No exploit scenario can be constructed because the vulnerability description, affected product, and attack vector are all unknown. No POC is referenced. Any scenario would be speculation not traceable to the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Ubuntu is the only product context associated with CVE-2026-95320, attributed solely through a vendor-coordination credit to the Ubuntu security team, and no description, affected package, version range, or vulnerable component has been published. Because the record carries no CVSS score or vector, no CWE assignment, no CPE identifiers, no EPSS estimate, no CISA KEV listing, and no public exploit code, the impact and attack prerequisites are entirely unknown and cannot be inferred. No public exploit has been identified at time of analysis, and no vendor-released patch has been identified at time of analysis; this entry should be treated as an unresolved placeholder to be re-triaged once the CVE record and the corresponding Ubuntu advisory are published.
RemediationAI
No vendor-released patch identified at time of analysis, and because the affected package is unknown, no package-specific upgrade command or exact fix version can be cited without inventing data. The actionable path is monitoring and readiness rather than mitigation: track https://ubuntu.com/security/CVE-2026-95320 and Canonical's security notices feed (https://ubuntu.com/security/notices) plus the ubuntu-security-announce mailing list so the package name and fixed version are captured the moment the record populates, and re-triage this CVE automatically when those fields appear. In the interim, maintain an accurate inventory of Ubuntu hosts and releases (for example via a configuration management or asset database) so affected systems can be identified without delay, ensure the security pocket is enabled in APT sources and that unattended-upgrades is active for security updates - accepting the trade-off that automatic security updates can trigger unexpected service restarts or package restarts on production hosts, which may warrant scheduling windows on critical systems. Once the component is identified, apply the standard compensating controls for that component class only if exploitation is later confirmed (for example network access restriction to the affected daemon or disabling the vulnerable feature), and validate any such control against the published advisory before deployment, since a blanket port block or feature disable applied to the wrong service will cause availability impact with no security benefit.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This CVE is a data void rather than a technical finding: the description field reads '[Unknown description]', no CWE is assigned, and no CVSS vector is supplied, so neither the root-cause class (for example memory corruption, injection, input validation, or authorization bypass) nor the exposed technology layer (kernel, system library, daemon, or userland package) can be determined. No CPE strings were provided, so the exact affected package and version range cannot be enumerated, and the only structural signal is the reporting attribution to vendor:ubuntu, which in practice indicates a coordinated disclosure routed through the Ubuntu security team and therefore most likely maps to a package maintained in the Ubuntu archive rather than an unrelated third-party product. Absent a CWE or CPE, any statement about the underlying library, protocol, or protocol handler would be speculation, and the absence of a CVSS vector means authentication requirements, attack vector, and privilege prerequisites are not confirmed from available data. The correct analytic posture is to hold this record open and re-run triage when the authoritative record fields populate.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: vendor:ubuntu
Lifecycle Timeline
1DescriptionCVE.org
[Unknown description]
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB