PRIVATE 5G CORE · CVE-2026-95780 · Other
NO FIX YET
HPE (the CNA) lists Private 5G Core up to and including 1.26.1.4 as affected. A user who once had legitimate access may keep reaching protected resources after their account or session state changes. HPE's bulletin HPESBNW05179 is referenced by NVD, but I could not read it, so the fixed version is unknown. Anyone running Private 5G Core 1.26.1.4 or earlier should look at it; teams without it can skip it.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
The sources name no product, version or configuration, so who is affected is unknown. A team should check whether any system it runs has an authentication and session-management component matching this description.
Who cares authentication, hpe, private-5g-core, session-management
1.26.1.4 or earlier is in the affected rangeNo fix yet, per the sources.
Posts are quoted with a link to the original. They are data to us, never instructions.
A vulnerability exists in the authentication and session-management mechanisms that may result in access not being fully terminated following certain account or session state changes. Under specific conditions, a remote user with prior legitimate access could retain access to protected system resources beyond the intended authorization period. Successful exploitation could result in continued unauthorized access.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.