Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV N L N N U N N H 7.5 .0045 37.8 —
AFFECTED Product Versions Fixed n/a n/a – —
TIMELINE Apr 6 Reserved by mitre Jun 1 EXPLOIT PUBLISHED — CVE-2026-37233. Public exploit reference added. Jun 1 Published (CNA: mitre)
FlexRIC v2.0.0 contains an authorization bypass in the iApp's xApp isolation mechanism. The equality function eq_xapp_ric_gen_id() in src/ric/iApp/xapp_ric_id.c compares m0->xapp_id against itself (m0->xapp_id) instead of the other argument (m1->xapp_id), effectively ignoring the xApp identity dimension. A malicious xApp connected to the iApp (port 36422) can delete any other xApp's subscriptions by sending an E42_RIC_SUBSCRIPTION_DELETE_REQUEST with a matching ric_gen_id. This breaks multi-tenant isolation in any deployment with multiple xApps sharing the same RIC.
| Date | Event | Detail |
|---|---|---|
| April 6, 2026 | Reserved | Reserved by mitre |
| June 1, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-37233. Public exploit reference added. |
| June 1, 2026 | Published | Published (CNA: mitre) |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| n/a | n/a | — | n/a | — |
Authoritative record: CVE-2026-37233 at cve.org
Weaknesses: CWE-617
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-37233 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.