CVE-2026-93308: O-RAN-SC SMO OAM RCE Vulnerability

CVE-2026-93308 Overview

CVE-2026-93308 affects the O-RAN Software Community (O-RAN-SC) Service Management and Orchestration (SMO) Operations, Administration, and Maintenance (OAM) release dated 2025-06-10. The flaw resides in the Virtual Event Streaming (VES) Collector component. An authenticated remote attacker can trigger uncontrolled resource allocation, mapped to [CWE-400], by sending crafted input to the collector. Public exploit details have been released, and the maintainers had not responded to the initial bug report at the time of disclosure.

Critical Impact
Remote low-privileged attackers can exhaust VES Collector resources, degrading availability of telemetry ingestion in O-RAN SMO deployments.

Affected Products

O-RAN-SC SMO OAM release 2025-06-10
VES Collector component within SMO OAM
Downstream O-RAN deployments that integrate the affected SMO OAM build

Discovery Timeline

2026-09-18 - CVE-2026-93308 published to the National Vulnerability Database (NVD)
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-93308

Vulnerability Analysis

The VES Collector ingests telemetry events from network functions in an O-RAN environment. The vulnerability allows an attacker with low privileges (PR:L) to submit manipulated requests that force the collector to allocate resources without bounded controls. Repeated or amplified requests can consume memory, threads, or connection handles until the service degrades or becomes unresponsive.

The issue is classified as Uncontrolled Resource Consumption [CWE-400], a common cause of denial-of-service conditions in network-facing collectors. Because the VES Collector centralizes telemetry from many managed elements, sustained exhaustion impacts operational visibility across the radio access network.

Root Cause

The root cause is missing or insufficient limits on resource allocation when handling attacker-influenced input paths in the VES Collector. Without upper bounds on allocations, per-connection quotas, or backpressure mechanisms, a low-volume abusive client can force disproportionate server-side work. The project's public bug tracker entry SMO-202 documents the reported behavior.

Attack Vector

Exploitation occurs over the network against an exposed VES Collector endpoint. The attacker requires valid low-level credentials but no user interaction. Public proof-of-concept material has been shared via a GitHub Gist Code Snippet and referenced in the VulDB CVE-2026-93308 entry. Refer to those references for the request pattern that triggers the resource allocation path.

Detection Methods for CVE-2026-93308

Indicators of Compromise

Sudden growth in VES Collector process memory, open file descriptors, or thread counts without a corresponding rise in legitimate network function reporting.
Repeated requests from a single authenticated client to VES Collector ingestion endpoints with anomalous payload characteristics.
Collector timeouts, dropped events, or restarts recorded in SMO OAM service logs.

Detection Strategies

Baseline normal VES Collector request rates per authenticated identity and alert on statistically significant deviations.
Correlate authentication logs with resource utilization metrics to attribute exhaustion patterns to specific accounts.
Inspect ingestion payloads for malformed or oversized fields consistent with the public proof-of-concept referenced by VulDB.

Monitoring Recommendations

Export VES Collector runtime metrics (heap, threads, sockets) to a centralized monitoring platform with alerting thresholds.
Enable request-level access logging on the collector and forward it to a SIEM for retention and query.
Track service restarts and out-of-memory events on hosts running SMO OAM components.

How to Mitigate CVE-2026-93308

Immediate Actions Required

Restrict network reachability of the VES Collector to trusted management planes and authenticated network functions only.
Rotate and tighten credentials used to authenticate to the collector, and remove unused low-privilege accounts.
Deploy rate limiting and connection quotas in front of the VES Collector using a reverse proxy or API gateway.

Patch Information

No vendor patch is referenced in the CVE data at the time of publication. The maintainers had not responded to the initial bug report tracked as SMO-202. Monitor the O-RAN-SC project and the VulDB Vulnerability #406594 entry for updates and fixed release information.

Workarounds

Place the VES Collector behind a reverse proxy that enforces per-client request rate limits and maximum payload sizes.
Apply operating system resource limits (ulimit, cgroups) to the collector process to contain runaway allocations.
Segment the SMO OAM management network so that only vetted network functions can reach the collector endpoint.

bash

# Configuration example
# Example nginx reverse-proxy rate limiting in front of VES Collector
# Adjust zone size, rate, and burst to match legitimate telemetry volume
limit_req_zone $binary_remote_addr zone=ves_ingest:10m rate=20r/s;

server {
    listen 8443 ssl;
    server_name ves-collector.internal;

    location /eventListener/ {
        limit_req zone=ves_ingest burst=40 nodelay;
        client_max_body_size 256k;
        proxy_pass http://ves_collector_upstream;
    }
}