PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-8743 Open5gs CVE debrief

CVE-2026-8743 is a remote improper-authorization issue in Open5GS AMF/MME context handling, specifically in ran_ue_find_by_amf_ue_ngap_id within src/amf/context.c. The supplied description says versions up to 2.7.6 are affected and that a public exploit exists, so this should be treated as a real exposure even though the published CVSS score is low (2.1).

Vendor
Open5gs
Product
Unknown
CVSS
LOW 2.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-17
Original CVE updated
2026-05-19
Advisory published
2026-05-17
Advisory updated
2026-05-19

Who should care

Teams operating Open5GS 5G core deployments, especially AMF/MME components and any environment that accepts untrusted or less-trusted signaling traffic, should review this promptly.

Technical summary

The CVE record describes an improper-authorization condition in Open5GS's AMF/MME code path for ran_ue_find_by_amf_ue_ngap_id. Based on the supplied record, the issue is remotely reachable and can be triggered through manipulation of inputs that influence UE-ID lookup/authorization behavior. The NVD record attributes the finding to CWE-266 and CWE-285, and the source reference set points to an upstream patch commit and related issue/PR in the Open5GS repository.

Defensive priority

Patch soon if Open5GS AMF/MME is deployed. The published CVSS is low, but the flaw is remotely reachable and the source description notes a public exploit, which raises operational urgency.

Recommended defensive actions

  • Apply the upstream fix referenced by commit 5746b8576cfceec18ed87eb7d8cf11b1fb4cd8b1, or upgrade to a version that includes it.
  • Inventory all Open5GS deployments and confirm whether AMF/MME is in scope for your environment.
  • Review exposure of 5G core signaling paths and limit access to trusted peers where possible.
  • Monitor for unusual authorization failures, unexpected UE-context lookups, or anomalous AMF/MME behavior.
  • Validate vendor guidance, release notes, or backport availability before scheduling maintenance in production environments.

Evidence notes

The supplied source corpus includes the CVE description, NVD record, and official repository references. Those sources consistently identify Open5GS AMF/MME, the function ran_ue_find_by_amf_ue_ngap_id in src/amf/context.c, affected versions up to 2.7.6, remote attackability, and a public-exploit claim. The patch reference is the upstream commit 5746b8576cfceec18ed87eb7d8cf11b1fb4cd8b1; related issue and pull request links are also included in the reference set. No exploit details are included here.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-8743 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-8743

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-8743 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-8743

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.