rootpwn

medium · CVSS v3 5.3

CVE-2026-93310

CVE-2026-93310 is a medium‑severity vulnerability in the O‑RAN‑SC SMO OAM 2025‑06‑10 VES Collector component. It allows a remote attacker to

Overview

CVE-2026-93310 is a medium‑severity vulnerability in the O‑RAN‑SC SMO OAM 2025‑06‑10 VES Collector component. It allows a remote attacker to manipulate resource allocation, potentially exhausting system resources or causing denial of service. The flaw is publicly known and the vendor has not yet released a fix.

Description

A vulnerability was identified in O-RAN-SC SMO OAM 2025-06-10. This affects an unknown part of the component VES Collector. The manipulation leads to allocation of resources. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through a bug report but has not responded yet.

Impact

The vulnerability can lead to a compromise of the confidentiality, integrity, and availability of the O‑RAN network management stack. Resource exhaustion may degrade service for all connected base stations and control plane components, impacting operators and end‑users. Defenders should treat it as a potential denial‑of‑service vector that could be leveraged in larger attack campaigns.

Remediation

1. Apply any vendor‑issued patch or update for the VES Collector as soon as it becomes available. 2. If a patch is not yet released, isolate the VES Collector from untrusted networks and enforce strict firewall rules. 3. Enable logging and monitoring for abnormal resource allocation patterns and set alerts for sudden spikes. 4. Conduct a thorough review of the O‑RAN SMO configuration to ensure that only authenticated, authorized management traffic is allowed. 5. Consider implementing rate limiting or quota controls on VES Collector endpoints to mitigate resource exhaustion.

Risk context

The CVSS v3 score of 5.3 indicates a medium risk level. With no EPSS data, the urgency is driven by the public availability of the exploit and the lack of vendor response. Operators should prioritize monitoring and containment until a patch is released.

Affected products

  • O‑RAN‑SC SMO OAM 2025‑06‑10
  • VES Collector
  • O‑RAN SMO
  • O‑RAN OAM
  • O‑RAN VES

Scores

Severity
medium
CVSS v2
5
CVSS v3
5.3
CVSS v4
—
EPSS
—

resource-allocation remote-exploitation O-RAN SMO VES-Collector medium denial-of-service

← All CVEs

Related CVEs

medium

CVE-2026-93312

A null pointer dereference in Poppler 26.07.0’s JBIG2Stream::rewind can be triggered remotely, causing a crash in PDF rendering. The flaw is limited to the Poppler library and does not directly expose data. Updating to 26.08.0 mitigates the issue.

View analysis

medium

CVE-2026-18441

The LatePoint Appointment Booking plugin for WordPress (v5.6.9 and earlier) contains an insecure direct object reference that allows unauthenticated users to enumerate customer records when guest checkout is enabled. Attackers can retrieve first name, last name, email, and phone number for any customer ID. This flaw exposes personally identifiable information without requiring authentication.

View analysis

medium

CVE-2026-2585

Brizy – Page Builder for WordPress has a stored cross-site scripting flaw in the rootAttributes parameter through version 2.8.14. Authenticated users with Contributor-level access or higher can inject scripts that run when visitors view affected pages. This matters because it can compromise site visitors and weaken trust in the WordPress site.

View analysis

medium

CVE-2026-93308

CVE-2026-93308 affects the VES Collector component of O-RAN-SC SMO OAM 2025-06-10. A remote attacker can manipulate an unknown functionality to trigger resource allocation, potentially exhausting system resources. The vulnerability is publicly known but no patch has been released yet.

View analysis