CVE-2026-61225: High severity Oracle Oracle Communications Converged Application Server vulnerability
Vulnerability in the Oracle Communications Converged Application Server product of Oracle Communications (component: Core). Supported versions that are affected are 8.2 and 8.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP/IP to compromise Oracle Communications Converged Application Server. Successful attacks of this vulnerability can result in takeover of Oracle Communications Converged Application Server. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
The affected supported versions are Oracle Communications Converged Application Server 8.2 and 8.3, specifically the Core component.
Does exploitation require authentication or user interaction?
No. An unauthenticated attacker with network access over TCP/IP can exploit the issue, and no user interaction is required.
What level of access does a successful attacker obtain?
Successful exploitation can result in takeover of Oracle Communications Converged Application Server, with high confidentiality, integrity, and availability impact.
How difficult is exploitation?
The vulnerability has high attack complexity and is described as difficult to exploit, although it is remotely reachable over TCP/IP.