Is CVE-2026-37227 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-37227 being exploited in the wild.

How severe is CVE-2026-37227?

Informational severity, with a CVSS score of 7.5, published 1 June 2026.

Which products and versions are affected?

EURECOM FlexRIC v2.0.0 through commit 6a595d8b.

Is there a fix for CVE-2026-37227?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-37227 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-37227?

Check whether you run EURECOM FlexRIC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-37227: EURECOM FlexRIC denial of service via reachable assertions in E2AP handlers

CVE-2026-37227 · Severity: info · CVSS 7.5 · Published 2026-06-01

FlexRIC, a controller used in 5G radio access networks, contains a flaw that allows a remote attacker to crash the system. By sending a specific type of network message that the software recognizes but has not yet fully implemented, an attacker can trigger an internal error that shuts down the controller. This results in a denial of service, potentially disrupting cellular network operations and management.

Technologies: EURECOM FlexRIC. Vendors: EURECOM.

Quick answers

Is CVE-2026-37227 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-37227 being exploited in the wild.
How severe is CVE-2026-37227?: Informational severity, with a CVSS score of 7.5, published 1 June 2026.
Which products and versions are affected?: EURECOM FlexRIC v2.0.0 through commit 6a595d8b.
Is there a fix for CVE-2026-37227?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-37227 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-37227?: Check whether you run EURECOM FlexRIC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

FlexRIC v2.0.0 (and versions through commit 6a595d8b) contains a reachable assertion failure (CWE-617) within its near-RT RIC component. The vulnerability exists in 'src/ric/msg_handler_ric.c' where several E2AP message types (such as E2nodeConfigurationUpdate and RIC_SUBSCRIPTION_FAILURE) are whitelisted for processing but lead to stub handlers containing unconditional 'assert(0)' calls. A remote, unauthenticated attacker can send a decodable E2AP PDU of these types to SCTP port 36421, causing the process to terminate via SIGABRT. As of the advisory date, no official patch is available; mitigation involves restricting SCTP access to trusted nodes.

Affected products

EURECOM FlexRIC v2.0.0 through commit 6a595d8b

Timeline

2026-06-01: advisory: NVD and researcher advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.