Quick answers
- Is CVE-2026-93310 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-93310 being exploited in the wild.
- How severe is CVE-2026-93310?
- Medium severity, with a CVSS score of 5.3, published 18 September 2026.
- Which products and versions are affected?
- O-RAN-SC SMO OAM 2025-06-10.
- Is there a fix for CVE-2026-93310?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-93310 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-93310?
- Check whether you run O-RAN-SC SMO OAM at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a denial-of-service (CWE-770) issue in the VES Collector component of O-RAN-SC SMO OAM. The root cause involves improper resource management when processing heartbeat and event messages, allowing attackers to send specially crafted VES events that trigger unbounded resource allocation. The attack is network-reachable and requires no authentication; an attacker can send HTTP requests to the collector's event listener endpoint (default port 8080) with malicious payloads. Proof-of-concept exploit code demonstrates a "sleeper attack" pattern using multiple concurrent threads to flood the collector with events designed to exhaust system resources. Patches or updates have not been provided by the project team as of the advisory date.
Affected products
- O-RAN-SC SMO OAM 2025-06-10
Timeline
- 2026-09-18: disclosed
- 2026-09-18: advisory: CVE-2026-93310 advisory published