CVE-2026-86212: Open5GS AMF/MME improper authorization
A vulnerability has been found in Open5GS 2.7.7/2.8.0. This vulnerability affects unknown code of the component AMF/MME. The manipulation leads to improper authorization. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 9468de94caed2fc940f4a23cbf734651896d0fde. To fix this issue, it is recommended to deploy a patch.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Open5GS AMF/MMEto a version that resolves this vulnerability.Patch 9468de94caed2fc940f4a23cbf734651896d0fde
Event History
Frequently Asked Questions
What level of access does an attacker need?
The CVSS vector indicates low privileges are required. Exploitation is remote and does not require user interaction.
What is the expected security impact?
The reported impact is limited to low availability impact. No confidentiality or integrity impact is indicated by the CVSS vector.
Which remediation is identified for affected deployments?
Deploy the patch identified as 9468de94caed2fc940f4a23cbf734651896d0fde. Public exploit disclosure means affected AMF/MME deployments should be prioritized for remediation.