CVE-2026-8268 describes a denial-of-service (DoS) vulnerability discovered in Open5GS versions 2.7.0 through 2.7.7. The vulnerability resides within the SMF component's OpenAPIlistcreate function, allowing remote attackers to induce a service disruption. While the issue has been reported to the Open5GS project, a response has not yet been received, leaving systems potentially exposed.
影響と攻撃シナリオ翻訳中…
Successful exploitation of CVE-2026-8268 allows an attacker to remotely trigger a denial-of-service condition within the Open5GS system. This means legitimate users and services relying on Open5GS will be unable to access or utilize the affected functionality. The impact can range from temporary service outages to complete system unavailability, potentially disrupting critical network operations. The ability to launch the attack remotely significantly broadens the potential attack surface, making it easier for malicious actors to target vulnerable deployments. The lack of a response from the project increases the risk of exploitation.
悪用の状況翻訳中…
CVE-2026-8268 has been publicly disclosed, increasing the likelihood of exploitation. The vulnerability's DoS nature makes it a relatively simple attack to execute, potentially lowering the barrier to entry for malicious actors. The EPSS score is likely to be assessed as Medium, reflecting the public disclosure and ease of exploitation. Active campaigns targeting this vulnerability are currently unknown, but the public disclosure warrants heightened vigilance.
脅威インテリジェンス
エクスプロイト状況
EPSS
0.04% (12% パーセンタイル)
CVSS ベクトル
これらのメトリクスの意味は？
- Attack Vector
- ネットワーク — インターネット経由でリモートから悪用可能。物理・ローカルアクセス不要。
- Attack Complexity
- 低 — 特別な条件不要。安定して悪用可能。
- Privileges Required
- 低 — 有効なユーザーアカウントがあれば十分。
- User Interaction
- なし — 自動かつ無音の攻撃。被害者は何もしない。
- Scope
- 変化なし — 影響は脆弱なコンポーネントのみ。
- Confidentiality
- なし — 機密性への影響なし。
- Integrity
- なし — 完全性への影響なし。
- Availability
- 低 — 部分的または断続的なサービス拒否。
影響を受けるソフトウェア
弱点分類 (CWE)
タイムライン
- 公開日
- EPSS 更新日
緩和策と回避策翻訳中…
Given the lack of a patch from the Open5GS project, immediate mitigation strategies are crucial. Consider implementing rate limiting on incoming requests to the SMF component to reduce the impact of potential DoS attacks. Network firewalls can be configured to block suspicious traffic patterns. If possible, isolate the Open5GS instance within a segmented network to limit the blast radius of a successful attack. Continuously monitor system logs for unusual activity that might indicate an ongoing attack. While a direct fix is unavailable, these workarounds can help reduce the risk until a patch is released.
修正方法翻訳中…
Se recomienda actualizar Open5GS a una versión posterior a la 2.7.7 para mitigar la vulnerabilidad de denegación de servicio. Verificar la documentación oficial de Open5GS para obtener instrucciones de actualización específicas. Dado que el proyecto no ha respondido, se recomienda monitorear activamente las actualizaciones de seguridad.
よくある質問翻訳中…
What is CVE-2026-8268 — DoS in Open5GS 2.7.0-2.7.7?
CVE-2026-8268 is a denial-of-service vulnerability affecting Open5GS versions 2.7.0 through 2.7.7. It allows remote attackers to disrupt service by manipulating the OpenAPIlistcreate function within the SMF component.
Am I affected by CVE-2026-8268 in Open5GS 2.7.0-2.7.7?
If you are running Open5GS version 2.7.0, 2.7.1, 2.7.2, 2.7.3, 2.7.4, 2.7.5, 2.7.6, or 2.7.7, you are potentially affected by this vulnerability.
How do I fix CVE-2026-8268 in Open5GS 2.7.0-2.7.7?
A patch is not currently available. Mitigate by implementing rate limiting, network firewall rules, and isolating the Open5GS instance.
Is CVE-2026-8268 being actively exploited?
While active campaigns are currently unknown, the vulnerability has been publicly disclosed, increasing the risk of exploitation.
Where can I find the official Open5GS advisory for CVE-2026-8268?
As of the publication date, no official advisory has been released by the Open5GS project. Monitor their website and mailing lists for updates.
今すぐ試す — アカウント不要
Upload any manifest (composer.lock, package-lock.json, WordPress plugin list…) or paste your component list. You get a vulnerability report instantly. Uploading a file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.
依存関係ファイルをドラッグ＆ドロップ
composer.lock、package-lock.json、requirements.txt、Gemfile.lock、pubspec.lock、Dockerfile...