CVE-2026-86212
Received Received - Intake

Improper Authorization in Open5GS AMF/MME Component

Publication date: 2026-09-06

Last updated on: 2026-09-06

Assigner: VulDB

Description
A vulnerability has been found in Open5GS 2.7.7/2.8.0. This vulnerability affects unknown code of the component AMF/MME. The manipulation leads to improper authorization. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 9468de94caed2fc940f4a23cbf734651896d0fde. To fix this issue, it is recommended to deploy a patch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-06
Last Modified
2026-09-06
Generated
2026-09-06
AI Q&A
2026-09-06
EPSS Evaluated
N/A
NVD
CVE-2026-86212
EUVD
EUVD-2026-72103

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
open5gs open5gs 2.7.7
open5gs open5gs 2.8.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a remote denial-of-service (DoS) flaw in Open5GS affecting the AMF component. It occurs when an unauthenticated NG RESET message with a 'partOfNG-Interface' ResetType is sent from one gNB referencing a UE served by a different gNB. This causes the AMF to crash due to improper handling of cross-gNB NG RESET operations.

Detection Guidance

Monitor AMF logs for assertion errors or crashes related to NG RESET operations. Check for malformed NG RESET messages with ResetType 'partOfNG-Interface' referencing UEs not served by the sending gNB. Use network traffic analysis tools to inspect NGAP messages for mismatched UE IDs or invalid reset requests.

Impact Analysis

An attacker can crash the entire AMF process by sending a single malformed NG RESET message, disrupting all UEs connected to the AMF. The attack requires only an accepted NG association and knowledge of a valid AMF-UE-NGAP-ID, without needing authentication or NAS messages.

Compliance Impact

This vulnerability, which causes a denial-of-service (DoS) in the AMF component of Open5GS, could impact compliance with GDPR and HIPAA by disrupting the availability of critical network services. A DoS attack may lead to unauthorized disruptions in data processing or communication systems, potentially violating requirements for data availability and security under these regulations.

Mitigation Strategies

Apply the patch from commit 9468de94caed2fc940f4a23cbf734651896d0fde. Ensure proper ownership validation in NG RESET handlers and add defensive checks in session release logic. Verify that all NG associations use IPsec to prevent unauthenticated reset messages.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86212. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart