Security readout for executives and security teams
Plain-English summary
CVE-2026-1587 can let a remote attacker crash or disrupt the Open5GS SGWC component by abusing modify-bearer request handling. The reported impact is denial of service, not data theft or code execution. Organizations running affected Open5GS 2.7.x versions should prioritize patch review, especially where mobile core interfaces are reachable beyond trusted network segments.
Executive priority
Treat as a near-term operational resilience issue for Open5GS environments. Prioritize telecom, lab, private 5G, or production mobile-core deployments where SGWC is active. Not currently KEV-listed, but public exploit disclosure raises patch urgency.
Technical view
The flaw affects Open5GS SGWC function sgwc_s11_handle_modify_bearer_request in /sgwc/s11-handler.c. Sources classify it as CWE-404 and CVSS 4.0 score 6.9, with network attack vector, low complexity, no privileges, and low availability impact. VulDB reports public exploit disclosure and that the issue is already fixed, but the bundle does not identify a fixed release or commit.
Likely exposure
Exposure is likely limited to deployments running Open5GS versions 2.7.0 through 2.7.6 with SGWC enabled. Risk is higher if S11 or related control-plane traffic can be reached from untrusted or poorly segmented networks.
Exploitation context
The source bundle states remote exploitation is possible and an exploit has been publicly disclosed. It does not show CISA KEV listing or confirmed active exploitation. The practical business risk is service disruption to affected Open5GS core network functions.
Researcher notes
Evidence supports affected versions, component, function, CWE, CVSS vector, remote unauthenticated reachability, and public exploit disclosure. The provided sources do not name a fixed release, commit, or active exploitation. Avoid assuming all Open5GS components are affected; the named component is SGWC.
Mitigation direction
- Identify Open5GS deployments and confirm whether SGWC is in use.
- Check vendor issue 4272 and Open5GS release guidance for the fixed patch level.
- Apply the vendor patch or upgrade once the fixed version is confirmed.
- Restrict SGWC/S11 access to trusted control-plane peers only.
- Monitor SGWC crashes, restarts, and unusual modify-bearer request patterns.
Validation and detection
- Inventory Open5GS versions and flag 2.7.0 through 2.7.6.
- Confirm whether SGWC binaries or services are deployed and active.
- Review network ACLs limiting access to SGWC control-plane interfaces.
- Check Open5GS issue 4272 for fix status and linked remediation details.
- Review logs for unexplained SGWC denial-of-service symptoms.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-404: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-1587 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.9 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
6.9MediumVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Source materials
- CVE List V5 sourceCVE List V5
- VDB-343350 | Open5GS SGWC s11-handler.c sgwc_s11_handle_modify_bearer_request denial of serviceCVE reference · vdb-entry, technical-description
- VDB-343350 | CTI Indicators (IOB, IOC, TTP, IOA)CVE reference · signature, permissions-required
- Submit #738376 | Open5GS SGWC v2.7.6 Denial of ServiceCVE reference · third-party-advisory
- https://github.com/open5gs/open5gs/issues/4272CVE reference · issue-tracking, exploit
- https://github.com/open5gs/open5gs/CVE reference · product
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Resource Shutdown or Release
Improper Resource Shutdown or Release represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.