Security readout for executives and security teams
Plain-English summary
CVE-2026-1586 is a remotely reachable denial-of-service flaw in Open5GS SGWC. A malformed or manipulated interaction can crash or disrupt service. It affects Open5GS 2.7.0 through 2.7.5 per the bundle. Public exploit material is reported, but there is no KEV listing or cited evidence of active exploitation.
Executive priority
Address in the next normal vulnerability remediation cycle, faster if Open5GS supports production mobile-core services or is reachable from untrusted networks. Business risk is service disruption, not confirmed data theft. Public exploit availability raises urgency above a routine medium-severity issue.
Technical view
The issue affects ogs_gtp2_f_teid_to_ip in /sgwc/s11-handler.c within the Open5GS SGWC component. It is classified as CWE-404 and scored CVSS 4.0 6.9. The vector indicates network access, low complexity, no privileges, and low availability impact. The report says the issue is already fixed, but the exact fixed release is not clearly established here.
Likely exposure
Organizations running Open5GS SGWC versions 2.7.0 through 2.7.5 are potentially exposed. Exposure is most relevant where SGWC control-plane interfaces are reachable by untrusted or insufficiently restricted network paths. Open5GS use in labs, private mobile cores, telecom testing, or research environments should be checked.
Exploitation context
The source bundle states the attack can be performed remotely and that exploit material has been published. However, KEV is false and the provided sources do not confirm active exploitation in the wild. Treat this as credible public-risk exposure, especially for internet-adjacent or weakly segmented deployments.
Researcher notes
Evidence is limited to vulnerability database and upstream issue references. The bundle says affected versions are 2.7.0-2.7.5 and the issue is already fixed, while one submission title mentions 2.7.6. Do not assume the fixed version without checking upstream Open5GS guidance.
Mitigation direction
- Inventory Open5GS deployments and identify SGWC versions.
- Prioritize Open5GS 2.7.0 through 2.7.5 for remediation review.
- Check Open5GS upstream guidance and issue 4273 for the fixed release or patch.
- Restrict SGWC-related control-plane access to trusted network segments.
- Monitor Open5GS processes for crashes, restarts, or abnormal SGWC errors.
Validation and detection
- Confirm the installed Open5GS version on each deployment.
- Verify whether SGWC is enabled and reachable from untrusted networks.
- Review GitHub issue 4273 and vendor release notes for fix confirmation.
- Check service logs for SGWC faults around GTPv2-C handling.
- Validate segmentation controls protecting Open5GS control-plane interfaces.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-404: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-1586 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.9 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
6.9MediumVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Source materials
- CVE List V5 sourceCVE List V5
- VDB-343349 | Open5GS SGWC s11-handler.c ogs_gtp2_f_teid_to_ip denial of serviceCVE reference · vdb-entry, technical-description
- VDB-343349 | CTI Indicators (IOB, IOC, TTP, IOA)CVE reference · signature, permissions-required
- Submit #738375 | Open5GS SGWC v2.7.6 Denial of ServiceCVE reference · third-party-advisory
- https://github.com/open5gs/open5gs/issues/4273CVE reference · issue-tracking, exploit
- https://github.com/open5gs/open5gs/CVE reference · product
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Resource Shutdown or Release
Improper Resource Shutdown or Release represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.