What is the CVSS score of EUVD-2026-46496?

EUVD-2026-46496 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of Pricing Design Center are affected by EUVD-2026-46496?

Oracle Communications Pricing Design Center versions 15.0-15.2 (on-premises) contains a privilege-boundary flaw enabling authenticated host users to read all sensitive data and modify critical…

How to fix or mitigate EUVD-2026-46496?

Within 24 hours, inventory all on-premises Pricing Design Center deployments and audit host-access permissions, immediately revoking unnecessary logon privileges to align with least-privilege principles. Within 7 days, implement network segmentation to isolate affected systems from broader infrastructure, enable comprehensive audit logging for privilege escalation attempts, and contact Oracle support for any available hardening guidance specific to 15.x branches. Within 30 days, establish and initiate a formal upgrade plan targeting a version beyond 15.2.0.0.0, scheduling this as critical infrastructure work with defined milestones and resource allocation.

Pricing Design Center EUVD-2026-46496

| CVE-2026-47007 HIGH

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-jvgp-p6jh-xjgh

Authentication Bypass Oracle Oracle Communications Pricing Design Center Oracle Corporation

7.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.3 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

vuln.today AI

7.3 HIGH

Requires an existing low-privileged host logon so AV:L/PR:L; scope change to adjacent products gives S:C, with high confidentiality, partial integrity, and no availability impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:21 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

HIGH 7.3

DescriptionCVE.org

Vulnerability in the Oracle Communications Pricing Design Center product of Oracle Communications (component: On-premise Deployment). Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Pricing Design Center executes to compromise Oracle Communications Pricing Design Center. While the vulnerability is in Oracle Communications Pricing Design Center, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Communications Pricing Design Center accessible data as well as unauthorized update, insert or delete access to some of Oracle Communications Pricing Design Center accessible data. CVSS 3.1 Base Score 7.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N).

AnalysisAI

Privilege-boundary compromise in Oracle Communications Pricing Design Center 15.0.0.0.0 through 15.2.0.0.0 (On-premise Deployment) lets a low-privileged attacker who already has a logon to the host infrastructure read all data accessible to the product and modify a subset of it, with a scope change that can significantly affect additional products. Oracle rates it CVSS 3.1 7.3 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N) and describes it as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Pricing Design Center (PDC) is the pricing and rating design application within Oracle's Communications BSS/billing stack (part of the Billing and Revenue Management ecosystem), used by telecom operators to model products, charges, and discounts. The affected component is the On-premise Deployment. Oracle assigned no CWE (CWE: N/A), and the intelligence tag 'Authentication Bypass' is the only structural hint at root-cause class; however, the CVSS vector requires PR:L (an existing low-privileged account on the infrastructure), which is more consistent with a privilege/authorization or trust-boundary weakness than a pure pre-authentication bypass. The scope change (S:C) indicates the vulnerable component can affect resources beyond its own security authority, meaning exploitation reaches other products or accounts in the deployment. The single CPE, cpe:2.3:a:oracle_corporation:oracle_communications_pricing_design_center:*, confirms PDC as the sole affected product family.

RemediationAI

Patch available per vendor advisory: apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); Oracle does not enumerate a single tagged patched version in the provided data, so consult the CPU patch matrix for the exact patch level corresponding to your 15.0.0.0.0-15.2.0.0.0 installation and apply it in your next maintenance window. Because exploitation requires a low-privileged logon to the infrastructure hosting PDC, effective compensating controls until patching are to tightly restrict and audit local/OS and application accounts on PDC hosts, remove unnecessary interactive logons, enforce least privilege, and network-segment PDC servers away from general user access - the trade-off is added operational friction for administrators and integration jobs that legitimately log on. Given the scope change, also review and constrain the trust relationships between PDC and the adjacent Oracle Communications products it can reach so a PDC compromise cannot pivot laterally.