PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-8223 Vuldb CVE debrief

CVE-2026-8223 is a medium-severity denial-of-service issue reported in Open5GS up to 2.7.7. The supplied record says a remote attacker can trigger the problem by manipulating the sm-policies endpoint path associated with pcf_sess_sbi_discover_and_send, resulting in service disruption. The record also states that a public exploit exists and that the project was notified early through an issue report.

Vendor
Vuldb
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-10
Original CVE updated
2026-05-10
Advisory published
2026-05-10
Advisory updated
2026-05-10

Who should care

Operators and defenders running Open5GS deployments, especially those exposing or relying on the SM policies endpoint, should review this issue. Network service teams should care because the impact is availability loss rather than data exposure.

Technical summary

The supplied vulnerability data attributes CVE-2026-8223 to the Open5GS function pcf_sess_sbi_discover_and_send in the sm-policies endpoint. According to the record, remote manipulation can lead to denial of service. The CVSS vector provided indicates network attackability with low complexity and no privileges or user interaction required, and availability impact limited to loss of availability. The weakness classification supplied with the record is CWE-404.

Defensive priority

Medium. Prioritize if you operate exposed Open5GS instances or depend on the SM policies service for availability-sensitive workloads.

Recommended defensive actions

  • Inventory Open5GS deployments and confirm whether any instance is at or below version 2.7.7.
  • Check whether the sm-policies endpoint is reachable from untrusted networks and restrict access where possible.
  • Monitor for service instability or crashes affecting Open5GS control-plane components.
  • Track upstream Open5GS advisories, issue #4438, and related release notes for a fix or workaround.
  • Apply vendor guidance or upgrade to a version confirmed by upstream to address the issue once available.

Evidence notes

This debrief is based only on the supplied CVE record and listed references. The record identifies Open5GS as the affected project, names the vulnerable function pcf_sess_sbi_discover_and_send, states that the issue can be triggered remotely, and says a public exploit exists. The supplied references include the Open5GS repository and issue #4438, plus VulDB submission and vulnerability pages. No additional verification was performed beyond the provided corpus.

Official resources

The supplied record shows public disclosure on 2026-05-10. It also states that a public exploit exists and that an earlier issue report was filed with the project.