Loading story…
Two high-severity vulnerabilities in Free5GC's Unified Data Management (UDM) component can be exploited remotely to disrupt 5G core subscriber data services in versions prior to 1.4.2. CVE-2026-33191 is a null byte injection issue in the supi path parameter of the Nudm_SubscriberDataManagement API. By sending URL-encoded null bytes such as %00, an attacker can trigger Go's net/url parser to fail with an invalid control character in URL error, causing the application to return a 500 Internal Server Error instead of safely rejecting the request.
A second flaw, CVE-2026-33064, allows a remote attacker to crash the UDM service through a crafted POST request to the /sdm-subscriptions endpoint containing path traversal sequences and a large JSON payload. The bug stems from a nil pointer dereference in the DataChangeNotificationProcedure function in notifier.go, which can trigger a runtime panic and leave UDM unavailable until restart. Both issues were fixed in Free5GC 1.4.2, and both carry high availability impact because they enable denial-of-service conditions against a core 5G network function.
See the actors and campaigns active against you right now.
2 events from the most recent confirmed update back to the earliest known activity.
Public records described two high-severity Free5GC UDM vulnerabilities in versions prior to 1.4.2: one causing 500 Internal Server Error through URL-encoded null bytes in the supi path parameter, and another causing a runtime panic through a crafted POST request with path traversal sequences and a large JSON payload. The disclosures linked the issues to denial-of-service impact and referenced the related advisories and fixing commits.
Free5GC version 1.4.2 fixed two UDM vulnerabilities affecting earlier versions: a null byte injection in the Nudm_SubscriberDataManagement API (CVE-2026-33191) and a nil pointer dereference in the DataChangeNotificationProcedure via /sdm-subscriptions (CVE-2026-33064). Both issues could be triggered remotely to disrupt UDM availability and cause denial of service.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity vulnerabilities in the **free5GC** UDR service allow unauthenticated attackers with access to the 5G Service Based Interface to tamper with **Traffic Influence Subscriptions**. **CVE-2026-40246** affects deletion logic and lets an attacker remove arbitrary subscriptions, while **CVE-2026-40248** affects create/update handling and allows arbitrary subscription creation or modification. In both cases, the vulnerable handlers validate the `influenceId` path segment against `subs-to-notify` but fail to halt execution after returning an HTTP `404 Not Found`, enabling the backend action to proceed anyway. The flaws affect free5GC UDR versions **1.4.2 and below** for the deletion issue and **4.2.1 and below** for the create/modify issue. The second bug can inject attacker-controlled `notificationUri` values and arbitrary **SUPIs**, creating a direct integrity risk in 5G core traffic influence workflows, while the deletion flaw threatens service availability by removing existing records. Both advisories describe network-accessible, low-complexity attacks requiring no privileges or user interaction, and no patched version was available at publication.
Jun 29, 2026
Attackers are actively exploiting **CVE-2026-20230**, a critical flaw in Cisco Unified Communications Manager (**Unified CM**) and Unified CM Session Management Edition (**Unified CM SME**), shortly after technical details and proof-of-concept code became public. Cisco said the bug stems from improper input validation in certain HTTP requests and can let an unauthenticated attacker perform **SSRF**, write arbitrary files to the underlying operating system, and potentially escalate privileges to **root**; researchers also described a path to unauthenticated remote code execution. Exploitation requires the **WebDialer** service to be enabled, although Cisco notes it is disabled by default. Exploit intelligence firm Defused reported seeing attacks from a single source using an unvetted PoC, with `file://` file-write payloads observed against decoy systems over the weekend. Cisco patched the issue in **Unified CM 14SU6** and **15SU5**, while SSD Secure Disclosure, which reported the vulnerability, published additional technical details showing how attackers could recover a target's true hostname and progress toward code execution. Cisco has advised customers to apply the fixes and, if patching cannot be done immediately, disable **WebDialer** to reduce exposure on widely deployed enterprise voice platforms.
Aug 15, 2026
Ubiquiti released Security Advisory Bulletin 065 to address five vulnerabilities in **UniFi OS**, including critical path traversal (`CVE-2026-47368`), privilege escalation (`CVE-2026-47369`), and command injection (`CVE-2026-47370`) flaws that affect a wide range of consoles, gateways, servers, NVRs, NAS devices, Dream Machines, Cloud Keys, and Express products. The advisory says a network-adjacent attacker could abuse the bugs to read arbitrary files, escalate privileges, execute commands, and in some cases make unauthorized configuration changes through `CVE-2026-48610`, with several issues rated as high as **CVSS 9.9**. Ubiquiti warned that the vulnerabilities can be chained, allowing attackers to remove privilege requirements and potentially reach full device compromise, echoing broader concern over repeated severe UniFi OS weaknesses. Firmware updates were issued with fixes in **UniFi OS 5.1.15** for most affected families, **5.1.16** for **UNAS** devices, and **4.0.15** for **Express** appliances; security reporting around the bulletin also urged organizations to patch all listed CVEs together and treat previously exposed, unpatched management interfaces as potentially compromised.
Jul 12, 2026