CVE-2026-49203CWE-287

Unauthenticated eSIM Configuration Manipulation

High · published June 4, 2026

CVSS v4.0
7.2
EPSS
0%
Percentile
19.6
In the wild
Unconfirmed
What it is

Crucial management API endpoints for cellular eSIM allocation do not validate caller authorization, allowing remote profiles to be rewritten or deleted.

The record
Technical detail
CVSS v4.0
7.2 · HIGH
Vector
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00281 · 19.6th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-06-04T06:25Z
EPSS history
Timeline
  • 04 JUN 06:25Z
    Unauthenticated eSIM Configuration Manipulation
    cvelistv5