What is the CVSS score of CVE-2026-61127?

CVE-2026-61127 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Communications Service Catalog and Design are affected by CVE-2026-61127?

Oracle Communications Service Catalog and Design (versions 8.0.0.7.0-8.3.0.2.0) contains a privilege escalation vulnerability in the Solution Designer component that allows any authenticated user to…

How to fix or mitigate CVE-2026-61127?

Within 24 hours, inventory all instances of Oracle Communications Service Catalog and Design versions 8.0.0.7.0 through 8.3.0.2.0 in production and non-production environments, implement network-level restrictions to limit HTTP access to the Solution Designer component to only authorized administrators, and enable enhanced logging and alerting for authentication attempts and privilege escalation events. Within 7 days, contact Oracle Support to request an expedited patch timeline or additional mitigation guidance, establish a change control window for patching once available, and conduct a security assessment of exposed systems for evidence of compromise. Within 30 days, apply the vendor patch immediately upon release to all affected versions, validate the patch in a staging environment that mirrors production, and decommission or fully air-gap any systems that cannot be patched within 60 days.

Oracle Communications Service Catalog and Design CVE-2026-61127

EUVD-2026-47336 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-72gw-xp27-f2wx

Privilege Escalation Oracle Communications Service Catalog And Design

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Remote HTTP exploitation with low complexity by an authenticated low-privilege user (PR:L) yielding full product takeover justifies high C/I/A and unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:40 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Communications Service Catalog and Design product of Oracle Communications (component: Solution Designer). Supported versions that are affected are 8.0.0.7.0-8.3.0.2.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Service Catalog and Design. Successful attacks of this vulnerability can result in takeover of Oracle Communications Service Catalog and Design. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Account/system takeover in Oracle Communications Service Catalog and Design (versions 8.0.0.7.0 through 8.3.0.2.0), Solution Designer component, lets a low-privileged attacker with network HTTP access fully compromise the product. Rated CVSS 3.1 8.8 with high confidentiality, integrity, and availability impact, Oracle describes it as 'easily exploitable,' meaning any authenticated user can escalate to complete control. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Oracle Communications Service Catalog and Design (formerly Ericsson/Oracle CSCD) is a telecom order-and-service design platform used by carriers to model and orchestrate products, services, and network resources; the affected Solution Designer component is the modeling/authoring subsystem exposed over HTTP as part of the application server tier. The advisory does not assign a CWE (listed N/A) and Oracle's CPU format omits root-cause detail, so the exact weakness class is not disclosed; however, the CVSS profile (network vector, low complexity, low privileges, full CIA impact, unchanged scope) combined with the 'takeover' language is consistent with an authorization/access-control or injection flaw reachable by any logged-in user. The EUVD/NVD CPE data resolves only to product version range 8.0.0.7.0 ≤ 8.3.0.2.0, with no more granular component CPE published.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle distributes remediation for this issue exclusively through that CPU, so administrators should identify their installed CSCD version within the 8.0.0.7.0-8.3.0.2.0 range and apply the corresponding CPU patch for their release train (Patch available per vendor advisory - the input does not include an exact standalone fix version, so confirm the precise patched build in the CPU patch matrix). Until patched, because exploitation requires an authenticated low-privilege account, reduce exposure by tightening access to the Solution Designer/HTTP interface: restrict network reachability of the application to trusted management networks or VPN, enforce least-privilege and prune unnecessary application accounts, rotate and strengthen credentials, and increase monitoring/logging of Solution Designer activity for anomalous privileged actions. These access restrictions may impede legitimate remote designers and should be validated against operational workflows before enforcement.