Cyber Resilience

CVE-2026-3269

Psi-Probe Psi Probe ≤ 5.3.0

Public PoC
Published
27 February 2026
Modified
03 March 2026
CVSS Score v4 5.3
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0056 43th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-3269 is a medium-severity Improper Resource Shutdown or Release (CWE-404) vulnerability in Psi-Probe Psi Probe. Its CVSS base score is 5.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked at the 43th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

A flaw has been found in psi-probe PSI Probe up to 5.3.0. The impacted element is the function handleRequestInternal of the file psi-probe-core/src/main/java/psiprobe/controllers/sessions/ExpireSessionsController.java of the component Session Handler. Executing a manipulation can lead to denial of service. The attack can…

more

be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CWE(s)
CWE-404

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1499 Endpoint Denial of Service Impact
Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users.
attack.mitre.org →
Why these techniques?

Remote DoS via improper resource handling in a server-side session component directly maps to endpoint denial of service via application exploitation.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-3270Same product: Psi-Probe Psi Probe
CVE-2026-3268Same product: Psi-Probe Psi Probe
CVE-2024-0736Shared CWE-404
CVE-2023-5259Shared CWE-404
CVE-2025-4756Shared CWE-404
CVE-2025-4867Shared CWE-404
CVE-2025-3167Shared CWE-404
CVE-2026-8731Shared CWE-404
CVE-2026-8223Shared CWE-404
CVE-2026-10069Shared CWE-404

Affected Assets

psi-probe
psi probe
≤ 5.3.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SC-5 Denial-of-service Protection
  • SI-10 Information Input Validation
  • AC-6 Least Privilege
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST 800-53 r5) AI

SC-5 Denial-of-service Protection good match
prevent

Directly requires mechanisms to protect against or limit effects of DoS attacks targeting the session expiration handler.

SI-10 Information Input Validation good match
prevent

Requires validation of inputs to handleRequestInternal, preventing malformed requests that trigger improper resource release leading to DoS.

AC-6 Least Privilege partial match
prevent

Restricts privileges on the Session Handler component so only authorized users can invoke ExpireSessionsController.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly include coding standards for correct resource allocation and release.

DE.CM-09 partial match
prevents

Runtime monitoring can detect resource exhaustion caused by improper shutdown or release.

ID.AM-08 partial match
prevents

Lifecycle management of assets can encompass proper resource release at end-of-life or shutdown.

PR.IR-04 partial match
prevents

Capacity management helps surface leaks from unreleased resources but does not prevent the coding flaw.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.37 Documented operating procedures partial match
prevents

Including restart, recovery and media-handling instructions reduces the likelihood that resources or sensitive data will be left in an exposed or improperly released state after a failure.

References