Description

Vulnerability in the Oracle Communications Converged Application Server product of Oracle Communications (component: Security). Supported versions that are affected are 8.2 and 8.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP/IP to compromise Oracle Communications Converged Application Server. While the vulnerability is in Oracle Communications Converged Application Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Communications Converged Application Server. CVSS 3.1 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.0",
  "pubDate": "2026-07-21T22:18:53.577Z",
  "pubdate": "2026-07-21T22:18:53.577Z",
  "executiveSummary": "This vulnerability affects Oracle Communications Converged Application Server versions 8.2 and 8.3, specifically within the Security component.\nThe flaw allows an unauthenticated, remote attacker with network access via TCP/IP to execute a full compromise of the application server.\nCategorized with a CVSS 3.1 Base Score of 9.0, the vulnerability exhibits a scope change (S:C) impact, meaning an exploit in this component can facilitate unauthorized access or control over additional, secondary products or integrated systems.\nThe attack complexity is rated as high, yet it does not require user interaction or pre-existing privileges, posing a critical risk to the confidentiality, integrity, and availability of the affected environment.\nSuccessful exploitation results in a complete takeover of the Oracle Communications Converged Application Server, potentially leading to unauthorized data exfiltration, system manipulation, or service disruption across the infrastructure.",
  "technicalDetails": "The vulnerability resides within the Security component of the Oracle Communications Converged Application Server, specifically in versions 8.2 and 8.3. The root cause pertains to an underlying security flaw in how the component manages network-based authentication or session handling, permitting unauthorized command or code execution.\nThe exploit vector is strictly remote (Network/AV:N), utilizing TCP/IP as the transport layer to reach the vulnerable service. Because the application server acts as a centralized node for communication services, a failure in its security enforcement allows an attacker to bypass standard authentication mechanisms entirely (PR:N, UI:N).\nThe attack flow proceeds as follows: 1) The attacker initiates a connection over TCP/IP to the targeted Oracle Communications Converged Application Server instance. 2) The attacker submits a crafted payload designed to trigger the security oversight within the application's processing logic. 3) Given the high severity of the flaw, the application fails to validate the request origin or session integrity, allowing the payload to execute within the security context of the server process. 4) The scope change (S:C) indicates that the impact is not limited to the local application server process; the attacker can leverage the server's elevated position to transition into adjacent systems or internal network resources that the application server is authorized to access.\nPost-exploitation, the attacker achieves full control over the application server, allowing for the exfiltration of sensitive communication data, modification of server configurations, or the use of the server as a pivot point for lateral movement. The 'High' complexity factor likely implies that the attacker must carefully time the request or align the payload with specific server states, but the ultimate outcome is a total compromise of the affected component."
}