Security Digest: May 8, 2026 - 67 Critical Vulnerabilities
Security teams must urgently address 67 newly identified critical vulnerabilities affecting various platforms, including free5GC, Termix, and VM2.
· 5 min read
Security Digest: May 8, 2026 - 67 Critical Vulnerabilities
Today's digest highlights critical vulnerabilities that demand immediate attention to protect your systems from potential exploits. Key actions include patching vulnerable software and revisiting security configurations to mitigate risks.
Executive Summary
Security teams must urgently address 67 newly identified critical vulnerabilities affecting various platforms, including free5GC, Termix, and VM2. Immediate action is required to patch systems and prevent potential exploitation. Specifically, focus on addressing authentication bypasses and remote code execution risks.
Critical Vulnerabilities
- CVE-2026-44330: Authentication Bypass in free5GC NEF
- Impact: Unauthorized access to PFD data and subscriptions, allowing data leakage and manipulation.
- Affected Systems: free5GC v4.2.1
- Immediate Action: Apply the upstream fix: GitHub fix
- Mitigation: Ensure OAuth2 is correctly configured and enforced.
- CVE-2026-44329: Critical Auth Bypass in free5GC SMF
- Impact: Potential unauthorized topology management, leading to service disruption or manipulation.
- Affected Systems: free5GC v4.2.1
- Immediate Action: Apply the upstream fix: GitHub fix
- Mitigation: Review access controls and implement strict authentication measures.
- CVE-2026-44008: VM2 Sandbox Escape
- Impact: Remote code execution on host systems.
- Affected Systems: npm vm2
- Immediate Action: Upgrade to the latest patched version.
- Mitigation: Avoid running untrusted code in VM2 environments.
- CVE-2026-44009: VM2 Sandbox Escape
- Impact: Execute arbitrary commands on host systems.
- Affected Systems: npm vm2
- Immediate Action: Upgrade to the latest patched version.
- Mitigation: Implement strict sandboxing policies.
- CVE-2026-41512: RCE in ai-scanner
- Impact: Remote code execution via JavaScript injection.
- Affected Systems: ai-scanner v1.0.0 to <1.4.1
- Immediate Action: Upgrade to version 1.4.1 or higher.
- Mitigation: Validate and sanitize all user inputs.
Previously Alerted
- CVE-2026-41070
- CVE-2026-41683
- CVE-2026-41432
- CVE-2026-42352, CVE-2026-42353, CVE-2026-42224, CVE-2026-42351
- CVE-2026-42354
- CVE-2026-44334
- CVE-2026-41497
- CVE-2026-42298
What to Do Now
- Immediately patch or upgrade vulnerable systems as per the listed CVEs.
- Review and enhance access controls, particularly for exposed APIs.
- Monitor network traffic for unusual patterns that may indicate exploitation attempts.
- Verify system logs for unauthorized access attempts and system errors.
Related Resources
- Refer to our internal blog for detailed analysis on similar vulnerabilities.
- Official vendor advisories are available on respective GitHub pages linked above.