CVE-2016-9796

Public exploit available. Not confirmed exploited in the wild yet. No fix published yet.

CVSS 3.09.8Critical EPSS percentile96th13% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 2 sources FixNone yetNo fix or workaround published

Published 2016-12-03Updated 2026-05-06Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check whether you run OmniVista 8770 Network Management System and whether TCP port 30024 is reachable from untrusted networks.
There is no confirmed fixed version available; ask your Alcatel-Lucent/Nokia support contact for the supported remediation path.
Block inbound TCP port 30024 at firewalls except from specifically approved management systems.
Review the server for unexpected administrator-level commands, jobs, or configuration changes.

May need vendor or contractor work

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Alcatel-Lucent OmniVista 8770 2.0 through 3.0 exposes different ORBs interfaces, which can be queried using the GIOP protocol on TCP port 30024. An attacker can bypass authentication, and OmniVista invokes methods (AddJobSet, AddJob, and ExecuteNow) that can be used to run arbitrary commands on the server, with the privilege of NT AUTHORITY\SYSTEM on the server. NOTE: The discoverer states "The vendor position is to refer to the technical guidelines of the product security deployment to mitigate this issue, which means applying proper firewall rules to prevent unauthorised clients to connect to the OmniVista server."

In plain language

Written by AI from the record

OmniVista 8770 Network Management System versions 2.0 through 3.0 can let a network-connected attacker take full control without logging in, so restrict access to port 30024 now.

Unauthenticated network RCE via exposed GIOP/ORB interfaces on TCP port 30024 allows execution of operating-system commands with full administrative privileges.

If you're affected

Full server takeover
Network management disruption
Network configuration changes
Sensitive data exposure
Ransomware risk

What is it

A weakness in this network-management server can allow an outsider who reaches it to skip the normal sign-in process and run commands as its top-level administrator. It is like someone finding an unlocked service entrance to your control room and being able to operate every switch inside.

Who is affected

This matters to you if you run OmniVista 8770 Network Management System. No account or employee action is needed; it is a risk only if an attacker can reach TCP port 30024 and the server responds to these management-interface requests.

How urgent is it

An attacker who can reach the exposed service can take over the server without a login. Public proof-of-concept code exists, although it is not in the U.S. government catalog of vulnerabilities known to be actively exploited; treat this as an amber-priority exposure and restrict network access promptly.

What to do — in detail

Confirm exposure by identifying OmniVista 8770 Network Management System deployments and testing, from authorized network locations, whether TCP/30024 is reachable and responds to GIOP queries. The affected releases are 2.0 through 3.0; no vendor fixed version or supported upgrade target is available in the findings, so obtain written guidance from the vendor before attempting an upgrade.

If patching cannot be completed, place the server behind firewall rules that permit TCP/30024 only from explicitly approved management hosts, with no internet or untrusted-network access. Review system and application records for unexpected job creation, command execution, new administrative activity, and unusual connections to port 30024. This CVE is not listed in CISA KEV, so there is no CISA remediation due date.

Technical context

CVE-2016-9796 is CVSS 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). It is an unauthenticated network attack against GIOP-accessible ORB interfaces on TCP/30024, involving authentication bypass (CWE-287) and improper access control (CWE-264), leading to arbitrary OS command execution with full administrative privileges. Two public GitHub PoCs are known. EPSS is 13.4% (96th percentile) and falling; it is not listed in CISA KEV, and the findings do not confirm exploitation in the wild.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS96th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

2 sources with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

13% chance of exploitation activity in the next 30 days, which ranks it in the 96th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Attention now

Rising.

Lifecycle

23 events over 3581 days, from the signal feeds we watch.

2026-09-23EPSS band changelow → moderateepss band change
2026-09-21EPSS band changemoderate → lowepss band change
2026-09-06EPSS band change0 → moderateepss band change
2026-09-05EPSS band changemoderate → 0epss band change
2026-08-31EPSS band change0 → moderateepss band change
2026-08-29EPSS band changemoderate → low

Affected products

alcatel-lucentcommercial · FRaka alcatel lucent
- omnivista 8770 network management systemOn-premCommunications / voip-telephony

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable