CVE-2026-42082— free5GC: Missing Concurrent NAS SMC Validation During NGAP Handover
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-42082
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
free5GC: Missing Concurrent NAS SMC Validation During NGAP Handover
Source: NVD (National Vulnerability Database)
Vulnerability Description
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, the AMF in Free5GC does not enforce the concurrent security procedure rules defined in 3GPP TS 33.501 §6.9.5.1. The AMF does not check for ongoing N2 handover procedures before initiating a NAS Security Mode Command, and vice versa. This can lead to mismatches between NAS and AS security contexts in the network and the UE. This vulnerability is fixed in 4.2.2.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
不恰当实现的标准安全检查
Source: NVD (National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-42082
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-42082
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-42082 (1)
Same Patch Batch · free5gc · 2026-05-27 · 20 CVEs total
| CVE-2026-44327 | 10.0 CRITICAL | free5GC: NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM hand |
| CVE-2026-44329 | 10.0 CRITICAL | free5GC: SMF UPI management interface lacks auth middleware; unauthenticated topology read |
| CVE-2026-44330 | 10.0 CRITICAL | free5GC: NEF nnef-pfdmanagement API is unauthenticated; forged bearer tokens can read PFD |
| CVE-2026-44326 | 9.4 CRITICAL | free5GC: NEF 3gpp-traffic-influence API is unauthenticated; missing or forged bearer token |
| CVE-2026-44315 | 9.4 CRITICAL | free5GC: NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, |
| CVE-2026-42083 | 8.2 HIGH | free5GC: PCF Npcf_SMPolicyControl missing authentication middleware allows unauthenticated |
| CVE-2026-44328 | 8.2 HIGH | free5GC: SMF UPI DELETE /upi/v1/upNodesLinks/{ref} panics on AN-node deletion via nil UPF |
| CVE-2026-44322 | 7.5 HIGH | free5GC: NEF 3gpp-pfd-management PATCH applications/{appId} panics on UDR access failure d |
| CVE-2026-44316 | 7.5 HIGH | free5GC: PCF npcf-smpolicycontrol POST /sm-policies panics on downstream UDR/OpenAPI 404 v |
| CVE-2026-44319 | 7.5 HIGH | free5GC: NEF crashes via logger.Fatal on PFD notification delivery failure (attacker-contr |
| CVE-2026-44321 | 7.5 HIGH | free5GC: SMF UPI POST /upi/v1/upNodesLinks exits the SMF process on overlapping UE pools ( |
| CVE-2026-44325 | 7.5 HIGH | free5GC: NRF POST /oauth2/token structured-form parser type-confusion panic family (Reflec |
| CVE-2026-44320 | 7.3 HIGH | free5GC: NEF nnef-callback route group is unauthenticated; forged callback requests are ac |
| CVE-2026-44324 | 6.5 MEDIUM | free5GC: UDR nudr-dr DELETE amf-subscriptions panics on missing UE state via nil interface |
| CVE-2026-44317 | 6.5 MEDIUM | free5GC: PCF npcf-policyauthorization POST /app-sessions panics on suppFeat=1 with missing |
| CVE-2026-44318 | 6.5 MEDIUM | free5GC: BSF concurrent PUT /nbsf-management/v1/subscriptions/{subId} crashes the BSF proc |
| CVE-2026-42081 | 6.1 MEDIUM | free5GC: UE Security Capability bypass on NGAP PathSwitchRequest |
| CVE-2026-44323 | 4.3 MEDIUM | free5GC: UDR nudr-dr DELETE amf-subscriptions panics on missing subsId when UE state exist |
| CVE-2026-42459 | free5GC: Improper Input Validation and Generation of Error Message Containing Sensitive In |
IV. Related Vulnerabilities
Same product: free5gc
- CVE-2026-42081
free5GC: UE Security Capability bypass on NGAP PathSwitchReq - CVE-2026-42083
free5GC: PCF Npcf_SMPolicyControl missing authentication mid - CVE-2026-42459
free5GC: Improper Input Validation and Generation of Error M - CVE-2026-44315
free5GC: NEF 3gpp-pfd-management API is unauthenticated; for - CVE-2026-44316
free5GC: PCF npcf-smpolicycontrol POST /sm-policies panics o
Same vendor: free5gc
- CVE-2026-42081
free5GC: UE Security Capability bypass on NGAP PathSwitchReq - CVE-2026-42083
free5GC: PCF Npcf_SMPolicyControl missing authentication mid - CVE-2026-42459
free5GC: Improper Input Validation and Generation of Error M - CVE-2026-44315
free5GC: NEF 3gpp-pfd-management API is unauthenticated; for - CVE-2026-44316
free5GC: PCF npcf-smpolicycontrol POST /sm-policies panics o
Same weakness: CWE-358
- CVE-2026-42081
free5GC: UE Security Capability bypass on NGAP PathSwitchReq - CVE-2026-44473
Ella Core: UE Downlink Redirection via Forged PDUSessionReso - CVE-2026-44475
Ella Core: UE Security Capability bypass on NGAP PathSwitchR - CVE-2026-44474
Ella Core: Handover failures during concurrent Security Mode - CVE-2025-31983
HCL BigFix Service Management (SM) is affected by a security
V. Comments for CVE-2026-42082
No comments yet