Is CVE-2026-37235 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-37235 being exploited in the wild.

How severe is CVE-2026-37235?

Informational severity, with a CVSS score of 9.1, published 1 June 2026.

Which products and versions are affected?

EURECOM FlexRIC v2.0.0 through commit 6a595d8b (2025-11-12).

Is there a fix for CVE-2026-37235?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-37235 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-37235?

Check whether you run EURECOM FlexRIC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-37235: EURECOM FlexRIC xApp impersonation and DoS in iApp component

CVE-2026-37235 · Severity: info · CVSS 9.1 · Published 2026-06-01

FlexRIC, a controller used in Open RAN cellular networks to manage radio functions, contains a vulnerability that allows an attacker to impersonate legitimate applications (xApps). By sending specially crafted messages, an attacker can trick the controller into misrouting data or commands to the wrong application. This can lead to a complete crash of the controller or the connected applications, disrupting cellular network operations and service availability.

Technologies: EURECOM FlexRIC. Vendors: EURECOM.

Quick answers

Is CVE-2026-37235 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-37235 being exploited in the wild.
How severe is CVE-2026-37235?: Informational severity, with a CVSS score of 9.1, published 1 June 2026.
Which products and versions are affected?: EURECOM FlexRIC v2.0.0 through commit 6a595d8b (2025-11-12).
Is there a fix for CVE-2026-37235?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-37235 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-37235?: Check whether you run EURECOM FlexRIC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

FlexRIC v2.0.0 fails to cryptographically or logically bind the 'xapp_id' field in E42 message payloads to the sender's underlying SCTP association. The validation function 'valid_xapp_id()' in 'src/ric/iApp/msg_handler_iapp.c' only verifies that the ID is within a valid numeric range rather than verifying ownership. A remote unauthenticated attacker can send E42_RIC_SUBSCRIPTION_REQUEST messages to port 36422 using a victim's predictable xapp_id. This results in response misrouting and state inconsistencies within the red-black tree data structures, leading to Denial of Service (DoS) via crashes of the victim xApp, the near-RT RIC, or the iApp component.

Affected products

EURECOM FlexRIC v2.0.0 through commit 6a595d8b (2025-11-12)

Timeline

2026-06-01: disclosed
2026-06-01: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.