CVE-2026-44325

Description

free5GC NRF: type-confusion panic in POST /oauth2/token structured-form parser via Reflect.Set on incompatible types

Overview

State

—

Assigner (CNA)

—

CVSS severity

high

CVSS score

7.5 / 10

CVSS vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Effective score

7.5 / 10 HIGH source: CNA overview

CWE(s)

—

Reserved

—

Published

—

Last updated

—

Source

https://www.tenable.com/cve/CVE-2026-44325

Linked Threat

CVE-2026-44325 — CVE-2026-44325

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID

EUVD-2026-32573

EUVD enrichment is queued; refresh the page in a few seconds.

Vendor references (0)

References embedded in the original CVE record by the assigning CNA.

None in the CVE record.

Web references (7)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

• https://github.com/free5gc/nrf/pull/83 tenable:github.com
• https://github.com/free5gc/free5gc/security/advisories/GHSA-f8qv-7x5w-qr48 tenable:github.com
• https://github.com/free5gc/nrf/commit/f7bc77daa7425506af7569f2e61c2a210f5a0423 tenable:github.com
• https://github.com/free5gc/free5gc/issues/918 tenable:github.com
• https://www.first.org/epss/ tenable:www.first.org
• https://www.cve.org/CVERecord?id=CVE-2026-44325 tenable:www.cve.org
• https://nvd.nist.gov/vuln/detail/CVE-2026-44325 tenable:nvd.nist.gov

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

• Microsoft and Adobe Patch Tuesday, April 2026 Security Update Review
  web:blog.qualys.com

  With Qualys Policy Audit's out-of-the-box mitigation or Compensatory Controls, which reduce the risk of a vulnerability being exploited because the remediation ( fix / patch ) cannot be done immediately, these security controls are not recommended by any industry standards, such as CIS and DISA-STIG.

  2026-05-26 02:49 UTC
• CISA Warns of Exploited Microsoft Defender 0-Day Flaws
  web:cyberpress.org

  The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two actively exploited Microsoft Defender vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, issuing an urgent remediation directive for federal agencies with a due date of June 3, 2026 .

  2026-05-26 02:49 UTC
• New PoC Exploit Published for Microsoft Defender 0-Day Flaw
  web:gbhackers.com

  A security researcher operating under the alias "Chaotic Eclipse" has publicly released a proof-of-concept (PoC) exploit for a vulnerability in Microsoft Defender.

  2026-05-26 02:49 UTC
• Patch Tuesday, April 2026 Edition - Krebs on Security
  web:krebsonsecurity.com

  For a clickable, per- patch breakdown, check out the SANS Internet Storm Center Patch Tuesday roundup. Running into problems applying any of these updates?

  2026-05-26 02:49 UTC
• Security Update Guide - Microsoft
  web:portal.msrc.microsoft.com

  The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

  2026-05-26 02:49 UTC
• CISA orders feds to patch BlueHammer flaw exploited as zero-day
  web:www.bleepingcomputer.com

  CISA has ordered U.S. federal agencies to patch a Microsoft Defender privilege escalation flaw (dubbed BlueHammer) that has been exploited in zero-day attacks.

  2026-05-26 02:49 UTC
• Microsoft is working on a patch for 'YellowKey ... - Computerworld
  web:www.computerworld.com

  Microsoft says it is considering a patch for a zero-day vulnerability, dubbed YellowKey, that allows attackers with access to a Windows device to bypass Bitlocker encryption protection and read ...

  2026-05-26 02:49 UTC
• April 2026 Patch Tuesday: Updates and Analysis | CrowdStrike
  web:www.crowdstrike.com

  Microsoft's April 2026 Patch Tuesday addresses 164 CVEs , featuring 8 Critical vulnerabilities, one exploited zero-day, and one disclosed zero-day.

  2026-05-26 02:49 UTC
• Microsoft fixes 167 security flaws in April, second biggest Patch ...
  web:www.pcworld.com

  This month's Patch Tuesday includes an actively exploited Office zero-day vulnerability and several critical RCE bugs in Windows and Remote Desktop.

  2026-05-26 02:49 UTC
• BlueHammer & RedSun: Windows Defender CVE-2026-33825 Zero-day ...
  web:www.picussecurity.com

  The exploit, referred to as "BlueHammer", was released prior to the availability of an official fix , making it a true zero-day at the time of disclosure. In this blog, we explain how the Windows Defender CVE - 2026 -33825 vulnerability works, its real-world risk to organizations, and provide practical steps for validation and remediation .

  2026-05-26 02:49 UTC

Only Available for Registered Users. Sign in to view.