CVE-2026-55366: IP Multimedia Subsystem Auth Bypass Flaw

CVE-2026-55366 Overview

CVE-2026-55366 is an authentication bypass vulnerability in the IP Multimedia Subsystem (IMS) component addressed in the Android Security Bulletin for September 2026. A logic error in the authentication code path allows a remote attacker to bypass identity verification and gain elevated privileges. Exploitation requires no user interaction and no prior privileges on the target device. The flaw is classified under [CWE-693] Protection Mechanism Failure and results in remote escalation of privilege over the network.

Critical Impact
Remote, unauthenticated attackers can bypass IMS authentication and escalate privileges on affected devices without any user interaction.

Affected Products

Android devices implementing the affected IP Multimedia Subsystem component
Google Pixel devices covered by the September 2026 Pixel bulletin
Refer to the Android Security Bulletin September 2026 for full device coverage

Discovery Timeline

2026-09-15 - CVE-2026-55366 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-55366

Vulnerability Analysis

The IP Multimedia Subsystem (IMS) provides the signaling framework for voice, video, and messaging services over IP on mobile devices. CVE-2026-55366 stems from a logic error in the IMS authentication path that allows requests to be processed as if the caller were already authenticated. Because IMS is reachable over the network stack and processes signaling traffic without user interaction, an attacker can trigger the flawed code path remotely. Successful exploitation yields escalated privileges within the IMS context, which can be leveraged to manipulate signaling state, subscriber identity handling, or associated telephony functions.

Root Cause

The underlying weakness is a Protection Mechanism Failure [CWE-693]. The authentication routine contains a logic error that permits the protection check to be reached in a state where it returns success without validating the required credentials or session context. This is a design-level flaw rather than a memory-corruption bug.

Attack Vector

The vulnerability is exploitable over the network against the IMS interface. No credentials are required, and the victim performs no action. An attacker crafts IMS signaling traffic that steers the authentication logic down the flawed branch, producing an authenticated session and the associated elevated privileges.

No verified proof-of-concept code is publicly available. See the Android Security Bulletin September 2026 for vendor-supplied technical details.

Detection Methods for CVE-2026-55366

Indicators of Compromise

Unexpected IMS registrations or re-registrations from unknown network peers or at anomalous times
Successful IMS authentication events without corresponding credential exchange or challenge-response traffic
Unusual SIP or Diameter signaling patterns targeting IMS endpoints on mobile carriers or enterprise IMS gateways

Detection Strategies

Correlate IMS registration and authentication logs from carrier core network elements against expected subscriber activity baselines
Monitor mobile device management (MDM) telemetry for Android build fingerprints that lack the September 2026 security patch level
Alert on privilege-context changes originating from the IMS service on Android endpoints

Monitoring Recommendations

Ingest carrier-side IMS signaling logs and Android device patch-level telemetry into a centralized analytics platform for correlation
Track patch compliance against the September 2026 Android Security Bulletin across the managed device fleet
Continuously monitor for anomalous outbound signaling from mobile endpoints, especially unattended or IoT-class devices

How to Mitigate CVE-2026-55366

Immediate Actions Required

Apply the September 2026 Android security patch level (2026-09-01 or later) to all affected devices
Prioritize patch deployment for devices exposed to untrusted mobile networks or roaming scenarios
Inventory devices that cannot receive the patch and plan for replacement or network-layer isolation

Patch Information

Google addressed CVE-2026-55366 in the September 2026 Android Security Bulletin. Devices must be updated to the 2026-09-01 security patch level or later. Consult the Android Security Bulletin September 2026 for the authoritative patch mapping and per-device guidance from OEMs.

Workarounds

No vendor-supplied workaround is documented; patching is the only complete remediation
Where patching is delayed, restrict device exposure to untrusted IMS networks and disable Voice over LTE (VoLTE) or Wi-Fi Calling on unpatched devices if operationally acceptable
Enforce MDM policies that block enrollment or network access for devices below the required patch level