EUVD-2026-79720
GHSA-5w4h-j5wf-w79f
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Network-reachable HTTP API with low complexity but requiring an existing low-privilege account, yielding partial confidentiality and integrity impact and no availability loss.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: SEPP). Supported versions that are affected are 26.1.200 and 25.2.201. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Security Edge Protection Proxy. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Cloud Native Core Security Edge Protection Proxy accessible data as well as unauthorized read access to a subset of Oracle Communications Cloud Native Core Security Edge Protection Proxy accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
AnalysisAI
Oracle Communications Cloud Native Core Security Edge Protection Proxy (SEPP) versions 26.1.200 and 25.2.201 permit a low-privileged, network-positioned attacker to reach the SEPP over HTTP and read a subset of its accessible data while also updating, inserting, or deleting some of that data. The flaw is rated 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), meaning exploitation needs an existing low-privilege account but no user interaction and no special attack complexity. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two concrete preconditions: (1) network reachability to the SEPP's HTTP interface - typically the N32 interconnect endpoint or the northbound management API - and (2) a valid low-privileged account, since the CVSS vector is PR:L, meaning this is not a pre-authentication bypass despite the 'Authentication Bypass' input tag. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) describes a remotely reachable, low-complexity flaw that nevertheless requires an attacker to already hold low privileges and grants only partial confidentiality and integrity impact with no loss of availability - a moderate, not critical, risk profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fix published in Oracle's Critical Patch Update advisory for Oracle Communications Cloud Native Core SEPP (https://www.oracle.com/security-alerts/cspusep2026.html); no exact patched build number is present in the supplied data, so confirm the corrected 26.1.200 / 25.2.201 maintenance release with Oracle Support before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today