CVE-2026-40465: Vulnerability in Nokia NSP

CVE-2026-40465 describes an open redirect vulnerability in Nokia NSP caused by insufficient server-side validation of the URL or redirect parameter. This vulnerability allows attackers to redirect users to arbitrary external URLs, which can be leveraged in phishing or social engineering attacks. The CVSS v3.1 base score is 5.3, reflecting a medium severity with network attack vector, high attack complexity, no privileges required, user interaction required, and impact limited to confidentiality. The vulnerability affects multiple specific versions of Nokia NSP as listed. There is no vendor advisory or patch available at this time, and no known active exploitation has been reported.

The vulnerability can be exploited to redirect users to malicious websites, potentially facilitating phishing or other social engineering attacks. There is no direct impact on integrity or availability. Confidentiality impact is rated high in the CVSS vector, indicating potential information disclosure risks if users are redirected to malicious sites that capture sensitive data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users and administrators should be cautious with URLs involving redirects in Nokia NSP. Monitor official Nokia channels for updates and apply patches promptly once released.