CVE-2026-8223
Last modified
CVE-2026-8223 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. A vulnerability was found in Open5GS up to 2.7.7. Affected by this vulnerability is the function pcf_sess_sbi_discover_and_send of the component sm-policies Endpoint. EPSS estimates a 0.48% chance of exploitation in the next 30 days.
Description
A vulnerability was found in Open5GS up to 2.7.7. Affected by this vulnerability is the function pcf_sess_sbi_discover_and_send of the component sm-policies Endpoint. Performing a manipulation results in denial of service. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Open5gs | Open5gs | <= 2.7.7 |
References
- https://github.com/open5gs/open5gs/issues/4438Exploit, Issue Tracking
- https://vuldb.com/submit/808442Third Party Advisory, VDB Entry
- https://vuldb.com/vuln/362440Third Party Advisory, VDB Entry
- https://vuldb.com/vuln/362440/ctiPermissions Required, VDB Entry
- https://vuldb.com/submit/808442Third Party Advisory, VDB Entry
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-8223?
How severe is CVE-2026-8223?
How do I fix CVE-2026-8223?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-82224Unauthenticated Cross Site Scripting (XSS) in SliceWP <= 1.2…7.1
- CVE-2026-82225Unauthenticated Broken Authentication in RegistrationMagic <…7.4
- CVE-2026-82226Unauthenticated PHP Object Injection in Tickera <= 3.6.0.2 v…9.8
- CVE-2026-82227Contributor SQL Injection in WPBulky <= 1.2.2 versions.8.5
- CVE-2026-82228Unauthenticated Bypass Vulnerability in SiteGround Security …8.1
- CVE-2026-82229Unauthenticated Cross Site Scripting (XSS) in WordPress Soci…7.1
- CVE-2026-82232Improper neutralization of special elements used in an SQL c…9.8
- CVE-2026-82233SiYuan before v3.8.1 contains a path traversal vulnerability…5.7
- CVE-2026-82234SiYuan versions before v3.8.1 contain a server-side request …8.2
- CVE-2026-82235filebrowser through 2.63.23 fails to validate named pipes in…5.9
- CVE-2026-82236File Browser versions from 2.63.6 through 2.63.23 fail to cl…3.1
- CVE-2026-82237filebrowser through 2.63.23 does not remove share records wh…3.1
Are you affected by CVE-2026-8223?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST