Executive brief
Oracle Communications Converged Application Server, a platform used by telecommunications providers to deploy multimedia services, contains a security vulnerability. A highly privileged attacker with network access could exploit this flaw to take full control of the server. Such an attack could lead to a complete service outage, unauthorized access to sensitive communications data, and potential impacts on connected downstream systems.
Technical details
A vulnerability exists in the Security component of Oracle Communications Converged Application Server version 8.3. The flaw is classified as difficult to exploit (Attack Complexity: High) and requires the attacker to have high-level administrative privileges. The attack vector is via the network using TLS. A successful exploit results in a scope change (S:C), meaning the attacker can impact components beyond the immediate security scope of the application server, leading to a total loss of confidentiality, integrity, and availability (C:H/I:H/A:H). The vulnerability was addressed in the Oracle Critical Patch Update for July 2026.
Affected products
- Oracle Communications Converged Application Server 8.3
Timeline
- 2026-07-21: disclosed
- 2026-07-21: advisory