What is the CVSS score of CVE-2026-61225?

CVE-2026-61225 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Communications CACS are affected by CVE-2026-61225?

Oracle Communications Converged Application Server 8.2 and 8.3 contain a critical vulnerability enabling complete remote server compromise without authentication, directly threatening continuity of…

How to fix or mitigate CVE-2026-61225?

Within 24 hours: Inventory all Oracle Communications Converged Application Server 8.2 and 8.3 systems and isolate them from untrusted network segments; remove internet exposure for non-essential instances. Within 7 days: Deploy enhanced logging and intrusion detection targeting CVE-2026-61225 exploitation patterns; establish baseline security configurations for forensic analysis. Within 30 days: Monitor Oracle's security advisories for patch release; test patched versions in pre-production and stage deployment plans, prioritizing systems currently exposed to external networks.

Oracle Communications CACS CVE-2026-61225

EUVD-2026-47422 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-rq3r-7m47-pr24

Privilege Escalation Oracle Communications Converged Application Server

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Unauthenticated network TCP/IP reach (AV:N/PR:N/UI:N) with Oracle-stated difficult exploitation (AC:H) yielding full takeover, so C/I/A all High.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:09 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Communications Converged Application Server product of Oracle Communications (component: Core). Supported versions that are affected are 8.2 and 8.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP/IP to compromise Oracle Communications Converged Application Server. Successful attacks of this vulnerability can result in takeover of Oracle Communications Converged Application Server. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full server takeover in Oracle Communications Converged Application Server 8.2 and 8.3 (Core component) is possible for an unauthenticated remote attacker over TCP/IP, per Oracle's July 2026 Critical Patch Update. Successful attacks yield high confidentiality, integrity, and availability impact (CVSS 3.1 8.1), but the attack is rated high-complexity (AC:H), meaning exploitation requires conditions outside the attacker's direct control. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV, indicating no confirmed active exploitation.

Technical ContextAI

Oracle Communications Converged Application Server (OCCAS) is a carrier-grade SIP/HTTP converged application server based on a Java EE/JSR 116/JSR 289 (SIP Servlet) container, used by telecom operators to host VoIP, IMS, and real-time communications applications. The vulnerability resides in the 'Core' component, which handles fundamental request processing and container services. Oracle did not assign a CWE (CWE: N/A) and provides no root-cause class detail; the network attack vector (AV:N) over TCP/IP combined with full C/I/A compromise is consistent with a memory-corruption, deserialization, or protocol-parsing flaw in the core request-handling path, but the exact weakness class is not disclosed in the available data. The 'Information Disclosure' tag hints at a data-exposure element, though the CVSS impact set (C:H/I:H/A:H, takeover) indicates the consequences extend well beyond disclosure to full compromise.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); patch available per vendor advisory, though the exact fixed build/version is not enumerated in the available data and should be obtained directly from the Oracle CPU matrix for OCCAS 8.2 and 8.3. Because Oracle security patches are cumulative, install the latest CPU rather than a single point fix. Until patching is complete, reduce exposure by restricting network reachability of the OCCAS management and SIP/HTTP listener ports to trusted signaling peers and administrative networks via firewall or ACLs, and place the server behind a Session Border Controller (SBC) or reverse proxy that can filter malformed protocol traffic - with the trade-off that legitimate signaling from new peers must be explicitly permitted. Given AC:H, tightening network exposure meaningfully raises the bar for an already difficult attack, but network controls are a compensating measure, not a substitute for the vendor patch.