Is CVE-2026-93309 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-93309 being exploited in the wild.

How severe is CVE-2026-93309?

Medium severity, with a CVSS score of 4.3, published 18 September 2026.

Is there a fix for CVE-2026-93309?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-93309 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-93309?

Check whether you run O-RAN-SC SMO OAM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-93309: O-RAN-SC SMO OAM VES Collector denial of service

CVE-2026-93309 · Severity: medium · CVSS 4.3 · Published 2026-09-18

O-RAN-SC SMO OAM is a management platform for Open RAN network infrastructure. The VES Collector component, which ingests event telemetry from network elements, is vulnerable to a denial-of-service attack via maliciously formatted chunked payloads. An attacker can remotely exhaust server memory and CPU resources, disrupting network monitoring and management capabilities.

Technologies: O-RAN-SC SMO OAM. Vendors: O-RAN-SC.

Quick answers

Is CVE-2026-93309 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-93309 being exploited in the wild.
How severe is CVE-2026-93309?: Medium severity, with a CVSS score of 4.3, published 18 September 2026.
Which products and versions are affected?: O-RAN-SC SMO OAM 2025-06-10.
Is there a fix for CVE-2026-93309?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-93309 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-93309?: Check whether you run O-RAN-SC SMO OAM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a CWE-770 resource exhaustion vulnerability in the VES Collector endpoint (HTTP listener on port 8080, path /eventListener/v7). The vulnerability stems from improper handling of chunked HTTP Transfer-Encoding in JSON event payloads. An attacker can send legitimate-looking VES events (e.g., heartbeat messages) split across multiple small chunks, forcing the collector to repeatedly allocate memory buffers while reassembling the payload. By varying chunk timing and payload sizes, and sending multiple concurrent requests from different source identities, an attacker can exhaust system resources without requiring authentication. The attack is network-accessible and has been publicly disclosed with proof-of-concept code demonstrating payload chunking and multi-threaded request patterns. Vendor response status is unknown at this time.

Affected products

O-RAN-SC SMO OAM 2025-06-10

Timeline

2026-06-26: disclosed: Proof-of-concept code published on GitHub (payload_chunking.py).
2026-09-18: advisory: CVE-2026-93309 published on NVD.
2025-06-10: other: Vulnerability identified in O-RAN-SC SMO OAM version dated 2025-06-10.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.