CVE-2026-40465 - Vulnerability Details - OpenCVE

NSP is vulnerable to an open redirect due to insufficient server-side validation of the URL (or redirect) parameter.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Nokia	Nsp

No data.

No data.

References

Link	Providers
https://www.nokia.com/we-are-nokia/security/product-security-advisory/cve-2026-40465/

History

Mon, 31 Aug 2026 21:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Nokia Nokia nsp
Vendors & Products		Nokia Nokia nsp

Mon, 31 Aug 2026 17:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 31 Aug 2026 16:30:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N'}`

Mon, 31 Aug 2026 08:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-601

Mon, 31 Aug 2026 06:45:00 +0000

Type	Values Removed	Values Added
Description		NSP is vulnerable to an open redirect due to insufficient server-side validation of the URL (or redirect) parameter.
Title		An Open Re-direct Vulnerability in Nokia NSP
References		https://www.nokia.com/we-are-nokia/security/product-security-advisory/cve-2026-40465/

MITRE

Status: PUBLISHED

Assigner: Nokia

Published: 2026-08-31T06:37:19.360Z

Updated: 2026-08-31T15:33:24.299Z

Reserved: 2026-04-13T11:28:52.517Z

Link: CVE-2026-40465

Vulnrichment

Updated: 2026-08-31T15:32:41.401Z

NVD

Status : Received

Published: 2026-08-31T07:17:43.857

Modified: 2026-08-31T16:18:00.520

Link: CVE-2026-40465

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40465", "assignerOrgId": "b48c3b8f-639e-4c16-8725-497bc411dad0", "state": "PUBLISHED", "assignerShortName": "Nokia", "dateReserved": "2026-04-13T11:28:52.517Z", "datePublished": "2026-08-31T06:37:19.360Z", "dateUpdated": "2026-08-31T15:33:24.299Z"}, "containers": {"cna": {"title": "An Open Re-direct Vulnerability in Nokia NSP", "descriptions": [{"lang": "en", "value": "NSP is vulnerable to an open redirect due to insufficient server-side validation of the URL (or redirect) parameter."}], "affected": [{"vendor": "Nokia", "product": "NSP", "versions": [{"version": "23.11", "status": "affected"}, {"version": "24.4", "status": "affected"}, {"version": "24.8", "status": "affected"}, {"version": "24.11", "status": "affected"}, {"version": "25.4", "status": "affected"}, {"version": "25.8", "status": "affected"}, {"version": "25.11", "status": "affected"}, {"version": "NSP 24.11-SP15", "status": "unaffected"}, {"version": "NSP 25.11-SP5", "status": "unaffected"}, {"version": "NSP 26.4 and later", "status": "unaffected"}]}], "references": [{"url": "https://www.nokia.com/we-are-nokia/security/product-security-advisory/cve-2026-40465/", "name": "Nokia Product Security Advisory"}], "providerMetadata": {"orgId": "b48c3b8f-639e-4c16-8725-497bc411dad0", "shortName": "Nokia", "dateUpdated": "2026-08-31T06:37:19.360Z"}, "x_generator": {"engine": "cveClient/1.0.15"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-601", "lang": "en", "description": "CWE-601 URL Redirection to Untrusted Site ('Open Redirect')"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-08-31T15:32:50.443352Z", "id": "CVE-2026-40465", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-31T15:33:24.299Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40465", "assignerOrgId": "b48c3b8f-639e-4c16-8725-497bc411dad0", "state": "PUBLISHED", "assignerShortName": "Nokia", "dateReserved": "2026-04-13T11:28:52.517Z", "datePublished": "2026-08-31T06:37:19.360Z", "dateUpdated": "2026-08-31T15:33:24.299Z"}, "containers": {"cna": {"title": "An Open Re-direct Vulnerability in Nokia NSP", "descriptions": [{"lang": "en", "value": "NSP is vulnerable to an open redirect due to insufficient server-side validation of the URL (or redirect) parameter."}], "affected": [{"vendor": "Nokia", "product": "NSP", "versions": [{"version": "23.11", "status": "affected"}, {"version": "24.4", "status": "affected"}, {"version": "24.8", "status": "affected"}, {"version": "24.11", "status": "affected"}, {"version": "25.4", "status": "affected"}, {"version": "25.8", "status": "affected"}, {"version": "25.11", "status": "affected"}, {"version": "NSP 24.11-SP15", "status": "unaffected"}, {"version": "NSP 25.11-SP5", "status": "unaffected"}, {"version": "NSP 26.4 and later", "status": "unaffected"}]}], "references": [{"url": "https://www.nokia.com/we-are-nokia/security/product-security-advisory/cve-2026-40465/", "name": "Nokia Product Security Advisory"}], "providerMetadata": {"orgId": "b48c3b8f-639e-4c16-8725-497bc411dad0", "shortName": "Nokia", "dateUpdated": "2026-08-31T06:37:19.360Z"}, "x_generator": {"engine": "cveClient/1.0.15"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-40465", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-31T15:32:50.443352Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-601", "description": "CWE-601 URL Redirection to Untrusted Site ('Open Redirect')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-31T15:32:41.401Z"}}]}}