Loading story…
Two high-severity vulnerabilities in the free5GC UDR service allow unauthenticated attackers with access to the 5G Service Based Interface to tamper with Traffic Influence Subscriptions. CVE-2026-40246 affects deletion logic and lets an attacker remove arbitrary subscriptions, while CVE-2026-40248 affects create/update handling and allows arbitrary subscription creation or modification. In both cases, the vulnerable handlers validate the influenceId path segment against subs-to-notify but fail to halt execution after returning an HTTP 404 Not Found, enabling the backend action to proceed anyway.
The flaws affect free5GC UDR versions 1.4.2 and below for the deletion issue and 4.2.1 and below for the create/modify issue. The second bug can inject attacker-controlled notificationUri values and arbitrary SUPIs, creating a direct integrity risk in 5G core traffic influence workflows, while the deletion flaw threatens service availability by removing existing records. Both advisories describe network-accessible, low-complexity attacks requiring no privileges or user interaction, and no patched version was available at publication.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-40247 was disclosed for free5GC UDR, describing improper path validation in the Traffic Influence Subscription read handler that lets unauthenticated attackers retrieve arbitrary subscription data despite an HTTP 404 response. The exposed data can include sensitive subscriber and network information, and no patched version was available at disclosure.
CVE-2026-40246 and CVE-2026-40248 were disclosed for free5GC UDR, describing improper path validation that lets unauthenticated attackers delete, create, or overwrite arbitrary Traffic Influence Subscriptions via the 5G Service Based Interface. At disclosure, no patched version was available for either issue.
A security advisory for CVE-2026-40246, affecting free5GC UDR path validation during deletion of Traffic Influence Subscriptions, was received by security-advisories@github.com. The flaw allows unauthenticated deletion of arbitrary subscriptions despite the API returning HTTP 404.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity vulnerabilities in **Free5GC**'s Unified Data Management (**UDM**) component can be exploited remotely to disrupt 5G core subscriber data services in versions prior to `1.4.2`. **CVE-2026-33191** is a null byte injection issue in the `supi` path parameter of the `Nudm_SubscriberDataManagement` API. By sending URL-encoded null bytes such as `%00`, an attacker can trigger Go's `net/url` parser to fail with an `invalid control character in URL` error, causing the application to return a `500 Internal Server Error` instead of safely rejecting the request. A second flaw, **CVE-2026-33064**, allows a remote attacker to crash the UDM service through a crafted `POST` request to the `/sdm-subscriptions` endpoint containing path traversal sequences and a large JSON payload. The bug stems from a nil pointer dereference in the `DataChangeNotificationProcedure` function in `notifier.go`, which can trigger a runtime panic and leave UDM unavailable until restart. Both issues were fixed in **Free5GC `1.4.2`**, and both carry high availability impact because they enable denial-of-service conditions against a core 5G network function.
Jun 29, 2026
Ubiquiti released Security Advisory Bulletin 065 to address five vulnerabilities in **UniFi OS**, including critical path traversal (`CVE-2026-47368`), privilege escalation (`CVE-2026-47369`), and command injection (`CVE-2026-47370`) flaws that affect a wide range of consoles, gateways, servers, NVRs, NAS devices, Dream Machines, Cloud Keys, and Express products. The advisory says a network-adjacent attacker could abuse the bugs to read arbitrary files, escalate privileges, execute commands, and in some cases make unauthorized configuration changes through `CVE-2026-48610`, with several issues rated as high as **CVSS 9.9**. Ubiquiti warned that the vulnerabilities can be chained, allowing attackers to remove privilege requirements and potentially reach full device compromise, echoing broader concern over repeated severe UniFi OS weaknesses. Firmware updates were issued with fixes in **UniFi OS 5.1.15** for most affected families, **5.1.16** for **UNAS** devices, and **4.0.15** for **Express** appliances; security reporting around the bulletin also urged organizations to patch all listed CVEs together and treat previously exposed, unpatched management interfaces as potentially compromised.
Jul 12, 2026
Ubiquiti released **Security Advisory Bulletin 064** to fix five vulnerabilities in **UniFi OS**, including three **unauthenticated remote code execution** flaws tracked as `CVE-2026-34908`, `CVE-2026-34909`, and `CVE-2026-34910`, each described by community reporting as **CVSS 10.0** issues affecting a broad range of **UDM, UCG, and UNVR** devices. The advisory also addressed `CVE-2026-33000`, a **CVSS 9.1** command injection vulnerability in **UniFi OS Server** that can let an attacker with administrative privileges and network access execute arbitrary operating system commands and potentially gain **root-level control** over managed infrastructure. The command injection bug was reported through **HackerOne** by researcher **V3rlust**, and Ubiquiti said `UniFi OS Server 5.0.8` and later contain the fix, while `5.0.6` and earlier are confirmed vulnerable. Public reporting noted that roughly **87,196 exposed UniFi Network Application hosts** were visible from the internet, raising concern that the unauthenticated RCE flaws could be chained with the command injection issue to compromise internet-facing deployments; administrators were urged to update firmware immediately, restrict management-plane exposure, and verify patch status across deployed systems.
Jul 10, 2026