Open5GS AMF/MME improper authorization

published 2026-09-06 2 mo ago modified 2026-09-11 58 d ago also EUVD-2026-72103

cvss: 4.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 42%
public exploits: 0; none known

A vulnerability has been found in Open5GS 2.7.7/2.8.0. This vulnerability affects unknown code of the component AMF/MME. The manipulation leads to improper authorization. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 9468de94caed2fc940f4a23cbf734651896d0fde. To fix this issue, it is recommended to deploy a patch.

Patch / fix

links 1

github.com/open5gs/open5gs@9468de9 commit

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 58 d ago (2026-09-11)

Exploit prediction

0.49% chance of exploitation in the next 30 days, higher than 42% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/open5gs/open5gs/issues/4680 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	5.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
CNA	3.1	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
CNA	3.0	4.3	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
CNA	2.0	4.0	AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C
CNA	4.0	2.1	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA	3.1	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CNA	2.0	4.0	AV:N/AC:L/Au:S/C:N/I:N/A:P

Affected products

n/a Open5GS

Classification

Weakness

CWE-285 Improper Authorization
CWE-266 Incorrect Privilege Assignment

References

github.com /open5gs/open5gs/commit/9468de94caed2fc940f4a23cbf734651896d0fde
patch
github.com /open5gs/open5gs/issues/4680
exploit, issue-tracking
vuldb.com /vuln/399348
vdb-entry
vuldb.com /vuln/399348/cti
signature, permissions-required
vuldb.com /cve/CVE-2026-86212
third-party-advisory
vuldb.com /submit/896623
third-party-advisory
github.com /open5gs/open5gs/
product

Sources

CVE List CVE-2026-86212
NVD CVE-2026-86212

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary