What is the CVSS score of CVE-2026-61226?

CVE-2026-61226 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Oracle Communications CACS are affected by CVE-2026-61226?

Oracle Communications Converged Application Server 8.3 contains a high-severity vulnerability enabling full compromise of affected servers and potential lateral movement to interconnected systems.

How to fix or mitigate CVE-2026-61226?

Within 24 hours, identify all systems running Oracle Communications Converged Application Server 8.3 and restrict local administrative access to documented essential personnel only. Within 7 days, implement network segmentation to isolate affected servers from other critical infrastructure, enable enhanced logging and monitoring for privilege escalation attempts targeting the RTP Proxy component, and document current security controls. Within 30 days, establish automated monitoring of Oracle's Critical Patch Update advisories for version 8.3 patches, review RTP Proxy configuration hardening options in Oracle documentation, and plan migration to patched versions upon vendor release.

Oracle Communications CACS CVE-2026-61226

EUVD-2026-47423 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-35q5-4f7h-p787

Oracle Authentication Bypass Communications Converged Application Server

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

7.5 HIGH

Requires local logon (AV:L) with pre-existing high OS privileges (PR:H) and is difficult to trigger (AC:H); scope change plus full takeover justify S:C and C/I/A:H.

3.1 AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:08 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle Communications Converged Application Server product of Oracle Communications (component: RTP Proxy). The supported version that is affected is 8.3. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Communications Converged Application Server executes to compromise Oracle Communications Converged Application Server. While the vulnerability is in Oracle Communications Converged Application Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Communications Converged Application Server. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Takeover of Oracle Communications Converged Application Server 8.3 is possible via a flaw in its RTP Proxy component, exploitable only by a high-privileged attacker with local logon to the host where the server runs. The CVSS 3.1 vector (AV:L/AC:H/PR:H/S:C) reflects difficult exploitation requiring existing elevated access, but a scope change means a successful attack can impact additional products beyond the server itself, with full confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; it was disclosed in Oracle's July 2026 Critical Patch Update.

Technical ContextAI

Oracle Communications Converged Application Server (OCCAS) is a SIP/HTTP converged application server used in telecom and IMS (IP Multimedia Subsystem) environments to host real-time communications applications. The affected RTP Proxy component relays Real-time Transport Protocol media streams between endpoints, typically for NAT traversal and media anchoring in VoIP/SIP call flows. No CWE was assigned in the available data, so the precise root-cause class (e.g., memory corruption, improper access control, or injection in RTP handling) cannot be confirmed; the local attack vector and scope change suggest the flaw lets a privileged local process cross a trust boundary into other components or products sharing the host.

RemediationAI

Apply the Oracle Critical Patch Update for July 2026, which contains the fix for this issue - Vendor-released patch: Oracle CPU July 2026 (see https://www.oracle.com/security-alerts/cpujul2026.html) for the exact patched build for OCCAS 8.3; Oracle does not publish a discrete semantic fix version outside the CPU, so no independent fix version can be cited here. Until the CPU is applied, reduce risk by tightly restricting local logon and administrative privileges on the host running OCCAS, since exploitation requires PR:H and local access - enforce least privilege on operating-system accounts, remove interactive shell access for service accounts, and monitor privileged sessions on the media-plane host. Because the flaw is in the RTP Proxy media path, restricting which processes and accounts can interact with the RTP Proxy and segmenting the media-plane host from other products (to blunt the scope-change impact) are meaningful compensating controls; the trade-off is added operational friction for administrators and potential impact on media/NAT-traversal functionality if RTP handling is constrained.