Is CVE-2026-82547 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82547 being exploited in the wild.

How severe is CVE-2026-82547?

Medium severity, with a CVSS score of 6.5, published 30 August 2026.

Is there a fix for CVE-2026-82547?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-82547 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-82547?

Check whether you run Linux Foundation Magma at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82547: Linux Foundation Magma improper authentication in Registration Complete message handler

CVE-2026-82547 · Severity: medium · CVSS 6.5 · Published 2026-08-30

Magma is an open-source mobile core network platform used by telecommunications providers to manage 5G infrastructure. A flaw in the Authentication and Mobility Management Function (AMF) allows attackers to bypass authentication by sending specific NGAP protocol messages, potentially gaining unauthorized access to the network without establishing proper security credentials. This could enable denial of service, unauthorized network access, or further compromise of network services.

Technologies: Linux Foundation Magma. Vendors: Linux Foundation.

Quick answers

Is CVE-2026-82547 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82547 being exploited in the wild.
How severe is CVE-2026-82547?: Medium severity, with a CVSS score of 6.5, published 30 August 2026.
Which products and versions are affected?: Linux Foundation Magma 1.9.0.
Is there a fix for CVE-2026-82547?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-82547 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-82547?: Check whether you run Linux Foundation Magma at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an improper authentication flaw in the Registration Complete message handler within the AMF finite state machine (amf_fsm.cpp). The root cause is that the AMF component accepts a Registration Complete message (sent via UplinkNASTransport) immediately after receiving an InitialUEMessage, without requiring prior completion of mandatory authentication and security mode establishment procedures. An attacker on the network can craft and send a sequence of NGAP messages to trigger an improper state transition from COMMON_PROCEDURE_INITIATED to REGISTERED_CONNECTED without authentication, bypassing security context establishment. This results in an authentication bypass and can trigger a denial of service crash in the MME/AMF. The vulnerability affects Magma 1.9.0 and is remotely exploitable; patches or fixes are not yet detailed in available sources.

Affected products

Linux Foundation Magma 1.9.0

Timeline

2026-07-15: disclosed: Bug report opened on GitHub
2026-08-30: other: CVE published / advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.