CVE-2026-8290 is a medium severity denial of service vulnerability affecting Open5GS up to version 2.7.7. The issue resides in the smf_nsmf_handle_update_data_in_vsmf function of the SMF component, where crafted input can cause the service to become unavailable. The vulnerability can be triggered remotely without authentication or user interaction. Although the exploit has been publicly released, no official remediation or patch has been announced by the Open5GS project. The CVSS 4.0 vector indicates low attack complexity and no required privileges, highlighting the ease of exploitation.

Successful exploitation results in denial of service of the Open5GS SMF component, potentially disrupting 5G core network functions relying on this software. This can lead to service outages affecting network availability. Since the attack can be performed remotely without privileges, it poses a significant operational risk. However, no evidence of active exploitation in the wild has been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround has been provided by the Open5GS project, organizations should monitor for updates from the vendor. Until a patch is available, consider implementing network-level protections such as filtering or rate limiting to reduce exposure to exploit attempts targeting the vulnerable function.