CVE-2026-93309 in SMO OAM
Summary
by MITRE • 09/18/2026
A vulnerability was determined in O-RAN-SC SMO OAM 2025-06-10. Affected by this issue is some unknown functionality of the component VES Collector. Executing a manipulation can lead to allocation of resources. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through a bug report but has not responded yet.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified in the O-RAN-SC SMO OAM component, specifically within the VES Collector module as reported on June 10, 2025, represents a significant security risk to Open Radio Access Network architectures. The core technical flaw involves an improper resource allocation mechanism that can be triggered by executing specific manipulations against the system. This issue falls under the category of CWE-400, which describes conditions where resources are not properly limited before consumption by a component, leading to potential denial-of-service or uncontrolled resource consumption. In the context of VES (Virtualized Environment Services) collectors, this flaw likely stems from insufficient validation or rate limiting when processing incoming event streams or configuration updates, allowing an attacker to force the system into allocating excessive memory, CPU cycles, or network bandwidth beyond its intended operational limits.
From a tactical perspective, this vulnerability is exploitable remotely, which significantly increases its severity and potential impact on production environments. The ability to launch attacks from external networks means that threat actors do not need prior access to the internal infrastructure to trigger resource exhaustion. This aligns with ATT&CK technique T1496, Resource Hijacking, where adversaries may use compromised systems for cryptomining or other computationally intensive tasks by exhausting available resources. However, in this specific case, the primary impact appears to be denial-of-service through resource depletion rather than direct system compromise via code execution. The public disclosure of the exploit indicates that proof-of-concept code is available, lowering the barrier to entry for malicious actors and increasing the likelihood of automated scanning and exploitation attempts against exposed O-RAN SMO instances.
The operational impact of this vulnerability can be severe, particularly in virtualized RAN deployments where resource constraints are critical for maintaining service continuity. If an attacker successfully exploits the VES Collector's resource allocation flaw, it could lead to the degradation or complete failure of network management functions dependent on that component. This disruption may cascade into broader network instability, affecting latency-sensitive applications and potentially causing outages in connected mobile services. Since the project has not yet responded to early bug reports, there is currently a window of exposure where organizations relying on this version of O-RAN-SC SMO are at heightened risk without official patches or mitigations provided by the vendor.
To mitigate these risks, immediate defensive measures should be implemented in lieu of software updates. Network segmentation strategies should be employed to restrict access to VES Collector endpoints from untrusted networks, ensuring that only authorized management stations can interact with the component. Implementing strict rate limiting and input validation at the network perimeter or within load balancers can help absorb malicious traffic before it reaches the vulnerable service. Additionally, monitoring tools should be configured to detect anomalous spikes in resource usage associated with VES Collector processes, allowing for rapid isolation of affected nodes during an active attack. Organizations must also review their incident response plans to account for potential denial-of-service scenarios stemming from this specific vulnerability until a vendor-approved patch is released and deployed.