PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-8122 Open5gs CVE debrief

CVE-2026-8122 is a denial-of-service issue reported in Open5GS NSSF, specifically in ogs_sbi_discovery_option_add_service_names within /lib/sbi/message.c. The supplied record says affected versions extend through 2.7.7, the attack can be performed remotely, and a public exploit has been referenced. NVD has analyzed the issue and assigns a low availability impact in its CVSS v4.0 vector, but the combination of remote reachability and a public exploit means exposed deployments should treat it as operationally relevant despite the low numeric score.

Vendor
Open5gs
Product
Unknown
CVSS
LOW 2.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-08
Original CVE updated
2026-05-11
Advisory published
2026-05-08
Advisory updated
2026-05-11

Who should care

Operators and integrators running Open5GS, especially environments using the NSSF component or exposing SBI-facing services to untrusted networks. Security teams responsible for telecom core infrastructure should review whether any deployed instance is at or below version 2.7.7.

Technical summary

The vulnerability is tied to ogs_sbi_discovery_option_add_service_names in Open5GS's /lib/sbi/message.c, under the NSSF component. The source corpus describes the flaw as a manipulation that leads to denial of service, and the NVD record maps it to a network-reachable issue with low privileges required and low availability impact. The affected CPE range listed by NVD is Open5GS versions up to and including 2.7.7.

Defensive priority

Medium

Recommended defensive actions

  • Inventory all Open5GS deployments and confirm whether NSSF is enabled or reachable.
  • Identify any systems running Open5GS version 2.7.7 or earlier and prioritize upgrade or vendor remediation as soon as a fixed release is available.
  • Restrict exposure of SBI and related management or inter-service interfaces to trusted networks only.
  • Monitor for abnormal NSSF behavior, process crashes, or service interruptions that could indicate attempted triggering of this issue.
  • Track the GitHub issue and vendor/NVD references for a confirmed fix or mitigation guidance.

Evidence notes

Source evidence in the supplied corpus includes the NVD analyzed record, which lists Open5GS as the affected product, a vulnerable CPE range ending at 2.7.7, a CVSS v4.0 vector indicating network attack, low privileges, and low availability impact, and references to the Open5GS repository plus GitHub issue 4435. The description supplied with the CVE states the issue can be performed remotely, causes denial of service, and that a public exploit has been made available. No fixed version is included in the provided source material.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-8122 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-8122

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-8122 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-8122

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.