CVE-2026-93309: O-RAN-SC SMO OAM VES Collector allocation of resources
A vulnerability was determined in O-RAN-SC SMO OAM 2025-06-10. Affected by this issue is some unknown functionality of the component VES Collector. Executing a manipulation can lead to allocation of resources. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through a bug report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of O-RAN-SC SMO OAM using the VES Collector component may be exposed. The affected functionality is not identified in the available information, so the precise configuration scope is unknown.
What does an attacker need to exploit it?
The attack can be launched remotely and has low attack complexity. The attacker must have low-level privileges; no user interaction is required.
What is the likely impact?
Successful exploitation can lead to resource allocation, with availability impact rated as low. No confidentiality or integrity impact is indicated by the supplied severity vector.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used.
What should teams do if no fix is available?
The available information states that the project was notified through a bug report but had not responded. Since no mitigation or fixed version is provided, restrict remote access to the VES Collector to authorized, least-privileged users and monitor for unexpected resource consumption.