Is CVE-2026-2521 actively exploited?

A proof-of-concept exploit is publicly available for CVE-2026-2521, but active exploitation has not been confirmed.

Can CVE-2026-2521 be exploited remotely?

Yes. CVE-2026-2521 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-2521?

CVE-2026-2521 has a CVSS score of 5.3 (MEDIUM) and an EPSS exploitation probability of 0.03%.

HOME VULNERABILITIESCVE-2026-2521

MEDIUMPOC

CVE-2026-2521

CWE-119Published: February 15, 2026· Updated: Feb 18, 2026

5.3

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:9.1th

Official Description

A weakness has been identified in Open5GS up to 2.7.6. This issue affects the function sgwc_s5c_handle_create_session_response of the component SGW-C. Executing a manipulation can lead to memory corruption. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

NVD Source

Technical Analysis

CVE-2026-2521 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A proof-of-concept (PoC) exploit exists for CVE-2026-2521. While not yet confirmed in active campaigns, the availability of PoC code increases exploitation risk substantially.

From a weakness classification perspective (CWE-119): Buffer overflow vulnerabilities can lead to arbitrary code execution or denial of service by corrupting adjacent memory.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorNetwork

Attack ComplexityLow

Privileges Req.None

User InteractionNone

ScopeUnchanged

Impact

ConfidentialityNone

IntegrityNone

AvailabilityLow

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected Vendors & Products

open5gs1 product

open5gs

Source: NVD CPE · 1 total CPE entries

Exploit & PoC Resources

POC AVAILABLEProof-of-concept code exists

Exploit-DB

Offensive Security exploit database

GitHub PoC Search

Community PoC repositories

Rapid7 / Metasploit

Metasploit module search

PacketStorm

Security advisories & exploits

External links open in a new tab. Always verify in a controlled environment before use.

Official Patches & Advisories

ADVISORYhttps://github.com/open5gs/open5gs/issues/4282

ADVISORYhttps://github.com/open5gs/open5gs/issues/4282#issue-3807902188

ADVISORYhttps://vuldb.com/?id.346109

ADVISORYhttps://vuldb.com/?submit.738334

News & Research Mentioning CVE-2026-2521

Hitachi Energy RTU500

CISA Alerts· Jun 4, 2026

View CSAF Summary Hitachi Energy is aware of vulnerabilities that affect RTU500 product versions listed in this document. If exploited, these vulnerabilities primarily impact product availability, with potential secondary impacts on confidentiality and integrity. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation. The following versions of Hitachi Energy RTU500 are affected: RTU500 series CMU Firmware vers:RTU500_series_CMU_Firmware/>=12.7.1| =13.5.1| =13.6.1| =13.7.1| =13.7.1|<=13.7.7 (CVE-2025-69421, CVE-2026-24515, CVE-2026-25210, CVE-2026-32776, CVE-2026-32777, CVE-2026-32778, CVE-2026-8479, CVE-2025-69421, CVE-2026-24515, CVE-2026-25210, CVE-2026-32776, CVE-2026-32777, CVE-2026-32778, CVE-2026-8479 [xlite_meta score:73 src:CISA Alerts xlite_fp:e0302865b72e9b97b1771d4c965cf7af6cfe4bd6f8338fe2df4d820e2ee37607]