Oracle Communications Service Catalog and Design CVE-2026-61127

Exploitation requires network access to the HTTP interface of the affected Oracle Communications Service Catalog and Design instance and a valid low-privilege account (CVSS PR:L) - it is NOT anonymous/unauthenticated. The vulnerable surface is the Solution Designer component in versions 8.0.0.7.0 through 8.3.0.2.0; no user interaction (UI:N) and no elevated privileges are needed beyond that initial low-privilege login, and attack complexity is low. The primary limiting factors are therefore the need for authenticated (even if minimal) credentials and reachability of the application's HTTP endpoint; internet-exposed or broadly-accessible deployments materially increase realistic risk, while instances confined to isolated management networks are substantially harder to reach.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8 High) indicates a genuinely dangerous, easily reachable flaw: remotely exploitable over HTTP, low attack complexity, no user interaction, and only a low-privilege account required, yielding full compromise. Oracle explicitly labels it 'easily exploitable,' reinforcing the low-complexity rating. No EPSS score is provided in the input, and there is no CISA KEV listing and no known public exploit code, so real-world exploitation probability cannot be quantified from the data - the signals are conflicting only in the sense that a high-CVSS, vendor-'easily exploitable' flaw currently lacks external corroboration of active attacks. The main mitigating factor is PR:L: an attacker needs some valid, if minimal, credentials, which limits fully anonymous internet exploitation. Given the enterprise/carrier deployment context and full-takeover impact, this should be treated as a high-priority patch during the July 2026 CPU cycle.

An attacker who has obtained or been granted a low-privilege application account (for example a limited designer or partner login) sends crafted HTTP requests to the Solution Designer component. Exploiting the flaw with low complexity and no user interaction, they escalate from that minimal foothold to full takeover of the CSCD instance, gaining read/write control over service catalog data and the application itself. No public proof-of-concept is available at this time, but Oracle's 'easily exploitable' characterization implies a reliable path once credentials are held.