CVE-2026-93310 in SMO OAM
Summary
by MITRE • 09/18/2026
A vulnerability was identified in O-RAN-SC SMO OAM 2025-06-10. This affects an unknown part of the component VES Collector. The manipulation leads to allocation of resources. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through a bug report but has not responded yet.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/18/2026
The identified vulnerability resides within the Virtualized Infrastructure Manager (VIM) Event Streamer Collector, specifically referred to as VES Collector, which is part of the O-RAN Software Center Service Management and Orchestration framework released on June 10, 2025. This component serves a critical function in Open RAN architectures by ingesting events from virtualized network functions and forwarding them to higher-level orchestration systems for monitoring and management. The core technical flaw involves an improper resource allocation mechanism that allows an attacker to trigger the continuous or excessive allocation of system resources such as memory, CPU cycles, or file descriptors without corresponding cleanup or bounds checking. This type of defect is characteristic of CWE-400, which describes situations where a process does not properly control the consumption and management of available resources, leading to resource exhaustion conditions that can degrade service availability for other components within the same infrastructure environment.
From an operational perspective, this vulnerability poses a significant risk to the stability and reliability of the O-RAN Service Management and Orchestration layer. Because the VES Collector is responsible for handling high-volume telemetry data from distributed radio units and virtualized network functions, any disruption in its ability to process events can lead to blind spots in network monitoring and control plane operations. An attacker leveraging this flaw could induce a denial of service condition by exhausting system resources, thereby preventing legitimate management traffic from being processed. This impacts the overall resilience of the open RAN ecosystem, as the Service Management and Orchestration layer relies on continuous event streams for real-time decision-making regarding network slicing, load balancing, and fault recovery. The inability to process these events effectively can result in delayed responses to critical network anomalies or complete failure of automated remediation workflows that depend on timely data ingestion.
The threat landscape surrounding this vulnerability is exacerbated by the fact that remote exploitation is possible, allowing attackers located outside the immediate network perimeter to initiate resource exhaustion attacks over standard communication protocols used for event streaming. Furthermore, exploit code has been publicly disclosed and may be actively utilized in automated attack campaigns targeting open RAN deployments. This public availability significantly lowers the barrier to entry for malicious actors who lack sophisticated development capabilities but seek to disrupt telecommunications infrastructure or use it as a pivot point for further lateral movement within enterprise networks. The combination of remote accessibility, resource exhaustion impact, and available exploit material creates a high-severity risk profile that demands immediate attention from security operations teams managing O-RAN environments.
Despite the severity of the issue, the project maintainers have not yet issued an official patch or advisory following early notification via bug report channels. This lack of vendor response necessitates reliance on community-driven mitigation strategies and defensive configurations until a formal fix is released. Organizations deploying this version of the SMO OAM framework should implement strict rate limiting and input validation controls at the network perimeter to restrict the volume of events that can be ingested by the VES Collector within specific time windows. Additionally, enforcing resource quotas and monitoring system metrics for anomalous spikes in memory or CPU usage associated with event processing threads can help detect active exploitation attempts early. It is also advisable to isolate the VES Collector from direct internet exposure using firewalls and zero-trust network access principles, ensuring that only authorized management systems can communicate with this component. Security teams should continuously monitor threat intelligence feeds for indicators of compromise related to O-RAN specific attacks and prepare to apply manual code patches or configuration hardening measures as soon as the vendor provides a resolution.