Security readout for executives and security teams
Plain-English summary
CVE-2026-1522 can let a remote attacker disrupt the Open5GS SGWC component, causing denial of service. It affects Open5GS 2.7.0 through 2.7.6. The issue is reported as fixed by patch b19cf6a, and public exploit material is referenced, so exposed telecom lab or production cores should be reviewed promptly.
Executive priority
Address in the next normal-to-urgent patch cycle, faster for internet-exposed, shared lab, or production mobile core environments. Business impact is service disruption rather than data theft based on available sources.
Technical view
The flaw affects sgwc_s5c_handle_modify_bearer_response in src/sgwc/s5c-handler.c within Open5GS SGWC. VulDB maps it to CWE-404 and CVSS 4.0 score 6.9, with network attack vector, low complexity, no privileges, no user interaction, and low availability impact. The report states manipulation can remotely trigger denial of service.
Likely exposure
Organizations running Open5GS 2.7.0, 2.7.1, 2.7.2, 2.7.3, 2.7.4, 2.7.5, or 2.7.6 may be exposed, especially where SGWC interfaces are reachable by untrusted or insufficiently controlled networks.
Exploitation context
The source bundle says exploit material is public and the attack can be launched remotely. CISA KEV status is false, and the provided sources do not confirm active exploitation in the wild. Treat this as credible denial-of-service risk, not confirmed widespread compromise.
Researcher notes
Evidence comes from VulDB, CVE records, and Open5GS GitHub references. The public issue references exploit material, but this analysis intentionally avoids reproduction details. The exact fixed release version is not stated in the provided bundle; only commit b19cf6a is named.
Mitigation direction
- Apply Open5GS patch b19cf6a or a vendor release that includes it.
- Prioritize systems running Open5GS 2.7.0 through 2.7.6.
- Restrict SGWC-related network reachability to trusted peers where operationally possible.
- Review Open5GS project guidance for any updated fixed versions or deployment notes.
- Plan maintenance windows because remediation may affect core network service availability.
Validation and detection
- Inventory Open5GS deployments and record exact versions.
- Confirm whether the b19cf6a fix is present in deployed builds.
- Check whether SGWC is enabled and reachable from untrusted networks.
- Review service logs for unexplained SGWC crashes or restarts.
- Track the GitHub issue and commit for follow-up vendor updates.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-404: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-1522 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.9 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
6.9MediumVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Source materials
- CVE List V5 sourceCVE List V5
- VDB-343193 | Open5GS SGWC s5c-handler.c sgwc_s5c_handle_modify_bearer_response denial of serviceCVE reference · vdb-entry, technical-description
- VDB-343193 | CTI Indicators (IOB, IOC, TTP, IOA)CVE reference · signature, permissions-required
- Submit #738371 | Open5GS SGWC v2.7.6 Denial of ServiceCVE reference · third-party-advisory
- https://github.com/open5gs/open5gs/issues/4266CVE reference · issue-tracking, exploit
- https://github.com/open5gs/open5gs/commit/b19cf6aCVE reference · patch
- https://github.com/open5gs/open5gs/CVE reference · product
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Resource Shutdown or Release
Improper Resource Shutdown or Release represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.