What is the CVSS score of CVE-2026-61224?

CVE-2026-61224 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Converged Application Server are affected by CVE-2026-61224?

Oracle Communications Converged Application Server 8.3 contains a high-severity vulnerability (CVE-2026-61224, CVSS 8.0) enabling complete system takeover with consequences spanning confidentiality,…

How to fix or mitigate CVE-2026-61224?

Within 24 hours: conduct an inventory of all Oracle Communications Converged Application Server 8.3 instances in production and non-production environments; restrict network access to the application server to explicitly authorized administrative hosts only; isolate systems where operationally feasible pending patch availability. Within 7 days: deploy network segmentation controls to limit TLS connections to the Converged Application Server to a minimal trusted administrative network; enable enhanced audit logging on all administrative activities and privileged account usage; review current access controls to identify and remove unnecessary high-privilege accounts. Within 30 days: monitor Oracle security advisories for patch releases; develop and execute a remediation plan that includes upgrading to a patched version when available or migrating to an alternative solution; perform a comprehensive security review of all accounts holding administrative privileges for this product.

Converged Application Server CVE-2026-61224

EUVD-2026-47421 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-rw3f-j562-h9wf

Authentication Bypass Oracle Communications Converged Application Server

8.0

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.0 HIGH

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

8.0 HIGH

TLS network reach gives AV:N, but AC:H per 'difficult to exploit' and PR:H per 'high privileged attacker'; S:C and full CIA match the stated takeover impact.

3.1 AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:10 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.0

DescriptionCVE.org

Vulnerability in the Oracle Communications Converged Application Server product of Oracle Communications (component: Security). The supported version that is affected is 8.3. Difficult to exploit vulnerability allows high privileged attacker with network access via TLS to compromise Oracle Communications Converged Application Server. While the vulnerability is in Oracle Communications Converged Application Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Communications Converged Application Server. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Full compromise (takeover) of Oracle Communications Converged Application Server 8.3 is possible via its Security component, where a high-privileged attacker with TLS network access can achieve confidentiality, integrity, and availability loss that also crosses a trust boundary to affect additional products (scope change). CVSS 3.1 scores this 8.0 despite high attack complexity and a high-privilege prerequisite. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; no EPSS value was supplied.

Technical ContextAI

Oracle Communications Converged Application Server (OCCAS) is a carrier-grade SIP/JEE application server used by telecom operators to build converged voice, video, and messaging services; the vulnerable code sits in its Security component and is reached over TLS. Oracle does not map a CWE for this issue (CWE: N/A) and provides no root-cause class, so the exact weakness (e.g., authentication/authorization bypass, deserialization, or crypto/session-handling flaw in the TLS-facing security layer) cannot be confirmed from the data. The scope change (S:C) indicates the flaw lets an authenticated actor break out of OCCAS's own security context to impact resources governed by a different security authority, consistent with a privileged-tier telecom middleware component that brokers access to downstream systems.

RemediationAI

Apply the fixes from Oracle's July 2026 Critical Patch Update; patch available per vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html (no discrete fixed build number is published in the supplied data - obtain the exact OCCAS 8.3 patch level from that advisory). Because exploitation requires high privileges over TLS, compensating controls while patching include tightening administrative and service-account privileges on OCCAS, restricting network reachability of the management and TLS interfaces to trusted operator segments and jump hosts (trade-off: may disrupt legitimate remote administration and inter-node traffic), enforcing strong mutual TLS and rotating credentials for privileged accounts, and increasing audit logging on the Security component to detect privilege abuse (trade-off: added log volume). Given the scope-change impact, also validate that no downstream products trust OCCAS beyond what is strictly required.