CVE-2026-61223
A critical vulnerability in Oracle Communications Converged Application Server versions 8.2 and 8.3 allows an unauthenticated attacker with network access to take over the server. Although the flaw is difficult to exploit, successful exploitation can lead to full compromise of confidentiality, integrity, and availability, and may affect other products due to scope change.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Oracle Communications Converged Application Server versions 8.2 and 8.3.
Real-world impact
Attackers could gain complete control of the affected server, potentially leading to data theft, modification, or service disruption, with possible spillover to other systems.
Why this severity
CVSS v3.1 base score 9.0 (Critical) due to high impacts on confidentiality, integrity, and availability, despite high attack complexity.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources