CVE-2026-52023

No known exploitation. EPSS puts it in the 38th percentile. A vendor fix is available.

CVSS 3.17.5High EPSS percentile38th0.4% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-09-01Updated 2026-10-19Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

KamailioAffected: ≤ 6.1.1Upgrade to: after 6.1.1Stated by: NVD

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether you run Kamailio 6.1.1 or earlier and have the ims_registrar_pcscf module enabled.
Apply the vendor’s upstream fix from commit 722c06b3efc53ccb369ce812c685c7d069508187; the findings do not identify a fixed release version.
Test call registration and related IMS functions after updating.
Until updated, restrict network access to the affected service to trusted carriers and internal systems.

Vendor advisory Some work to apply

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

An issue in kamailio v.6.1.1 and before allows a remote attacker to cause a denial of service via the ims_registrar_pcscf module, specifically the pcscf_save_pending/save_pending path and security-agreement parsing in sec_agree.c:parse_sec_agree()

In plain language

Written by AI from the record

Kamailio 6.1.1 and earlier has a flaw that can let an outside attacker knock the service offline, so businesses using its affected IMS feature should act soon.

Remote unauthenticated denial of service in Kamailio’s ims_registrar_pcscf module through the pcscf_save_pending/save_pending path and security-agreement parsing.

If you're affected

Voice service outage
Call registration disruption
Customer communication interruption
Operational downtime

What is it

This is a defect in a part of Kamailio used for IMS call-registration handling. It is like a caller being able to send a malformed request that jams a receptionist’s desk, preventing legitimate calls from being handled.

Who is affected

This matters to you if you run Kamailio and use the ims_registrar_pcscf module for IMS registration services. It is only a risk when remote requests can reach that affected feature, and an attacker does not need an account.

How urgent is it

There is no confirmed public exploitation and no public exploit code on record, so this is an amber priority rather than an emergency. Schedule the fix promptly because a remote attacker can disrupt the affected service without needing access first.

What to do — in detail

Confirm the installed Kamailio version and whether ims_registrar_pcscf is loaded and serves remote IMS registration traffic. The affected range is 6.1.1 and earlier; the supplied vendor findings identify the upstream remediation commit 722c06b3efc53ccb369ce812c685c7d069508187, but do not name fixed releases for individual branches. Update through your supported Kamailio packaging or source-management process, ensuring that the vendor commit is included, then validate IMS registration and security-agreement handling in a staging environment before deployment. If patching is delayed, limit access to the affected SIP/IMS service to trusted networks and carriers. No CISA KEV due date applies because this CVE is not listed in KEV. Watch for abnormal registration failures, process crashes, restarts, and unexpected service unavailability after deployment.

Technical context

CVSS v3.1 is 7.5 (High): AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The reported weakness types are CWE-415 and CWE-400, affecting security-agreement parsing in sec_agree.c:parse_sec_agree() and the pcscf_save_pending/save_pending path of ims_registrar_pcscf. CISA KEV does not list this CVE, and no public exploit code is on record. EPSS is 0.3% at the 26th percentile with a flat trend; this is a predicted likelihood, not evidence of exploitation. Press attention is rising, but that does not establish active exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS38th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.4% chance of exploitation activity in the next 30 days, which ranks it in the 38th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

11 events over 48 days, from the signal feeds we watch.

2026-10-19Patch availablerecord updated
2026-09-15OpenVAS check addedpatch available, record updated
2026-09-08Record updated
2026-09-03Record updated
2026-09-01Publishedweakness classified, att&ck mapped, record updated

Affected products

kamailiooss-project
- kamailioOn-premCommunications / voip-telephony

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Scored 7.5 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality NoneNo confidentiality impact
Integrity NoneNo integrity impact
Availability HighTotal denial of service — the component is completely unavailable