What is the CVSS score of CVE-2026-61223?

CVE-2026-61223 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Communications CASP are affected by CVE-2026-61223?

Oracle Communications Converged Application Server versions 8.2 and 8.3 contain a critical vulnerability permitting remote, unauthenticated attackers to achieve complete system compromise, including…

How to fix or mitigate CVE-2026-61223?

Within 24 hours, identify and inventory all Oracle Communications Converged Application Server 8.2 and 8.3 instances using network discovery and asset management tools to determine exposure scope. Within 7 days, implement network segmentation by placing affected servers behind firewalls with strict access controls, restricting inbound connectivity to authorized networks only, and disabling unnecessary remote management interfaces; simultaneously contact Oracle Support to establish a patch delivery timeline and register for critical update notifications. Within 30 days, apply any released patches from Oracle immediately to all affected instances; if patches remain unavailable, evaluate whether to migrate to a patched version or temporarily decommission non-critical instances until remediation is available.

Oracle Communications CASP CVE-2026-61223

EUVD-2026-47420 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-f5wj-332h-xrj5

Oracle Authentication Bypass Communications Converged Application Server

9.0

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.0 CRITICAL

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.0 CRITICAL

Network-reachable and unauthenticated (AV:N/PR:N) but Oracle-labeled difficult to exploit (AC:H); full takeover with impact on other products yields S:C and C:H/I:H/A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:09 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

CRITICAL 9.0

DescriptionCVE.org

Vulnerability in the Oracle Communications Converged Application Server product of Oracle Communications (component: Security). Supported versions that are affected are 8.2 and 8.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP/IP to compromise Oracle Communications Converged Application Server. While the vulnerability is in Oracle Communications Converged Application Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Communications Converged Application Server. CVSS 3.1 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle Communications Converged Application Server 8.2 and 8.3 is possible for a remote, unauthenticated attacker over TCP/IP, per Oracle's July 2026 Critical Patch Update. Rated CVSS 3.1 9.0 with a scope change (S:C), a successful attack can compromise confidentiality, integrity, and availability of the server and significantly impact additional connected products, though high attack complexity (AC:H) makes exploitation non-trivial. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle Communications Converged Application Server (OCCAS) is a carrier-grade SIP/HTTP application server (based on WebLogic/SIP Servlet technology) used by telecom operators to host converged voice, video, and web communications services. The flaw resides in the product's Security component; Oracle does not disclose a CWE (CWE: N/A), and the sparse public detail typical of Oracle CPU entries means the exact weakness class is not stated. The scope change (S:C) indicates the vulnerable component can be leveraged to affect resources beyond its own security authority - consistent with an application server that fronts or brokers other backend/converged services, so a compromise can pivot into adjacent products.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) - Patch available per vendor advisory; Oracle CPUs bundle the patched builds for the affected 8.2 and 8.3 releases, and the exact patch numbers must be pulled from that advisory and My Oracle Support as no discrete fix version string is given in the input. Until patching is complete, reduce network exposure of the OCCAS management and SIP/HTTP interfaces by restricting inbound TCP/IP access to trusted management networks and known SIP peers via firewall/ACLs (trade-off: may disrupt legitimate signaling peers if allow-lists are incomplete), place the server behind a session border controller or reverse proxy to filter malformed traffic, and increase monitoring of the Security component and any trust relationships to adjacent products given the scope change. These are compensating controls only; the CPU patch is the sole confirmed fix.