Is CVE-2026-37233 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-37233 being exploited in the wild.

How severe is CVE-2026-37233?

Informational severity, with a CVSS score of 8.2, published 1 June 2026.

Which products and versions are affected?

EURECOM FlexRIC v2.0.0 through at least commit 6a595d8b (2025-11-12).

Is there a fix for CVE-2026-37233?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-37233 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-37233?

Check whether you run EURECOM FlexRIC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-37233: EURECOM FlexRIC authorization bypass in iApp xApp isolation

CVE-2026-37233 · Severity: info · CVSS 8.2 · Published 2026-06-01

FlexRIC is a software controller used in cellular networks to manage radio access functions. A security flaw in its isolation mechanism allows a malicious application connected to the controller to delete the subscriptions and configurations of other applications. This breaks the separation between different users or services sharing the same network infrastructure, potentially leading to service disruptions.

Technologies: EURECOM FlexRIC. Vendors: EURECOM.

Quick answers

Is CVE-2026-37233 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-37233 being exploited in the wild.
How severe is CVE-2026-37233?: Informational severity, with a CVSS score of 8.2, published 1 June 2026.
Which products and versions are affected?: EURECOM FlexRIC v2.0.0 through at least commit 6a595d8b (2025-11-12).
Is there a fix for CVE-2026-37233?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-37233 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-37233?: Check whether you run EURECOM FlexRIC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authorization bypass exists in FlexRIC v2.0.0 within the iApp's xApp isolation mechanism. The root cause is a logic error in the equality function `eq_xapp_ric_gen_id()` located in `src/ric/iApp/xapp_ric_id.c`, where the code compares `m0->xapp_id` against itself instead of the second argument `m1->xapp_id`. This effectively ignores the xApp identity during validation. A malicious xApp connected to the iApp SCTP port (36422) can exploit this by sending an `E42_RIC_SUBSCRIPTION_DELETE_REQUEST` with a target's `ric_gen_id`, allowing it to delete subscriptions belonging to other xApps. This vulnerability breaks multi-tenant isolation in deployments where multiple xApps share the same RIC. No upstream patch was available at the time of disclosure.

Affected products

EURECOM FlexRIC v2.0.0 through at least commit 6a595d8b (2025-11-12)

Timeline

2026-06-01: disclosed
2026-06-01: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.