Oracle Communications CASP CVE-2026-61223

Exploitation requires network reachability to the OCCAS Security component over TCP/IP and no authentication (PR:N), but is limited by high attack complexity (AC:H): the attacker must satisfy conditions outside their direct control - such as winning a race, meeting a specific server state, or possessing environment-specific knowledge - which is why Oracle labels it 'difficult to exploit.' No user interaction is needed (UI:N). The input does not name a specific feature flag or non-default setting that must be enabled, so the concrete prerequisite beyond network access is the high-complexity condition itself; realistic risk is highest where the OCCAS SIP/HTTP or management interface is exposed to untrusted networks, and materially lower for instances confined to a hardened, segmented signaling network.

Signals are mixed. The CVSS 3.1 base score of 9.0 is Critical and driven by AV:N (network), PR:N (unauthenticated), UI:N (no user interaction), full C:H/I:H/A:H impact, and a scope change to other products - this is the classic 'complete takeover' profile. The key mitigating metric is AC:H (high attack complexity), meaning exploitation likely requires specific conditions, timing, or knowledge that the attacker cannot fully control, which tempers the raw severity. Countering the high CVSS: there is no EPSS score provided, no CISA KEV listing, and no evidence of a public POC, so real-world exploitation probability appears low-to-unknown rather than imminent. The 'Information Disclosure' tag is narrower than the description's 'takeover' claim - treat the tag as a partial label and defer to the full CIA-impact vector. Net: a genuine high-priority patch item for OCCAS operators because of the takeover potential and unauthenticated network reach, but AC:H and the absence of exploitation evidence suggest it is not being mass-exploited today.

A remote attacker with no credentials sends specially crafted traffic to an internet- or partner-reachable OCCAS 8.2/8.3 instance over TCP/IP, exploiting the flaw in the Security component to gain control of the server. Because of the scope change, the attacker then leverages the compromised application server's trust relationships to reach and impact adjacent backend or converged communications products. Exploitation is rated high-complexity, so it likely requires precise conditions or timing rather than a simple single-shot request, and no public POC is currently known.