5
CVEs
0
Critical
0
High
0
KEV
5
PoC
0
Unpatched C/H
0.0%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
0
MEDIUM
4
LOW
1
Monthly CVE Trend
Affected Products (1)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-82547 | Authentication bypass in Magma 1.9.0's AMF Registration Complete Message Handler allows remote, unauthenticated attackers to manipulate registration state in the 5G core network's Access and Mobility Management Function. The vulnerable code path resides in tasks/amf/amf_fsm.cpp, where the finite state machine processing Registration Complete messages fails to properly verify actor identity per CWE-287. A public proof-of-concept exploit exists (GitHub issue #16020), and no confirmed patch version has been identified at time of analysis. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-82550 | Improper input validation in the NGSetupRequest Handler of Linux Foundation Magma 1.9.0 allows remote unauthenticated attackers to impact availability of the 5G core's Access and Mobility Management Function (AMF) by supplying a malformed NG-IoT-DefaultPagingDRX argument. A public proof-of-concept is available via GitHub issue #16023, though the vulnerability has not been added to CISA KEV and the project maintainers have not responded to the coordinated disclosure, meaning no patch is available. The CVSS 4.0 score of 6.9 reflects limited availability impact only, with no confidentiality or integrity exposure. | MEDIUM | 5.5 | 0.4% | 48 |
PoC
No patch
|
| CVE-2026-82551 | State machine mismanagement in the NGSetup Handler of Linux Foundation Magma 1.9.0 allows remote, unauthenticated attackers to induce an invalid state in the AMF component by sending crafted NGAP NGSetup messages. The affected function resides in ngap_amf_handlers.c, which processes the initial setup handshake between 5G base stations (gNBs) and the Access and Mobility Management Function (AMF). A public proof-of-concept is available via a GitHub issue; this is not listed in the CISA KEV catalog. | MEDIUM | 5.5 | 0.3% | 48 |
PoC
No patch
|
| CVE-2026-82549 | Improper integrity check validation in Linux Foundation Magma 1.9.0's SecurityModeComplete Handler allows remote unauthenticated attackers to bypass NAS-layer security verification in the mobile core network. The SecurityModeComplete message is part of the LTE Non-Access Stratum security negotiation procedure; failure to validate the integrity check value (CWE-354) means crafted messages can be accepted without proper cryptographic verification. A publicly available proof-of-concept exists on GitHub, and the CVSS 4.0 vector confirms network-reachable, zero-prerequisite exploitation with low-level impact across confidentiality, integrity, and availability dimensions. | MEDIUM | 5.5 | 0.2% | 48 |
PoC
No patch
|
| CVE-2026-82552 | Denial of service via improper resource shutdown in Magma 1.9.0's gNB Termination Handler allows remote low-privileged attackers to disrupt or crash the AMF's NGAP processing of 5G base station connections. The flaw in tasks/ngap/ngap_amf.c stems from CWE-404 (improper resource release), producing availability impact against the vulnerable system with no confidentiality or integrity consequence. A public proof-of-concept exploit exists per the referenced GitHub issue #16019, though CISA has not confirmed active exploitation. | LOW | 2.1 | 0.3% | 31 |
PoC
No patch
|