What is the CVSS score of EUVD-2026-47351?

EUVD-2026-47351 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Convergent Charging Controller EUVD-2026-47351

| CVE-2026-61143 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-4h8j-4735-3w9g

Authentication Bypass Oracle Communications Convergent Charging Controller

6.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.4 MEDIUM

AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

6.4 MEDIUM

Network HTTP vector confirmed; PR:H and UI:R per description; full takeover yields C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 08:20 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Communications Convergent Charging Controller product of Oracle Communications (component: Prov IF). Supported versions that are affected are 15.0.0.0.0 and 15.2.0.0.0. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Communications Convergent Charging Controller. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Communications Convergent Charging Controller. CVSS 3.1 Base Score 6.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H).

AnalysisAI

Full system takeover of Oracle Communications Convergent Charging Controller (Prov IF component) is achievable by a high-privileged network attacker exploiting a difficult-to-trigger flaw over HTTP in versions 15.0.0.0.0 and 15.2.0.0.0. The attack requires human interaction from a third party in addition to prior high-privilege access, making opportunistic exploitation unlikely. No public exploit code exists and the vulnerability has not been added to the CISA KEV catalog at time of analysis, though the complete confidentiality, integrity, and availability impact warrants patching within standard enterprise patch cycles.

Technical ContextAI

Oracle Communications Convergent Charging Controller (CCC) is a telecom-grade real-time billing and charging platform, deployed primarily by telecommunications operators to manage subscriber charging sessions and provisioning workflows. The affected component, 'Prov IF' (Provisioning Interface), handles configuration and provisioning operations over HTTP. The CWE classification is not provided in available data, preventing precise root-cause categorization; however, the combination of high attack complexity (AC:H), human interaction requirement (UI:R), and full-takeover impact (C:H/I:H/A:H) is consistent with vulnerability classes such as server-side request forgery, insecure deserialization, or a complex authentication logic flaw within the provisioning interface. The vendor tag 'Information Disclosure' appears inconsistent with the described takeover impact - this discrepancy is noted but cannot be resolved from available data.

RemediationAI

Apply the patch issued by Oracle as part of the July 2026 Critical Patch Update (CPU), referenced at https://www.oracle.com/security-alerts/cpujul2026.html. A specific patched version number is not confirmed in the available input data - consult the Oracle CPU advisory directly to obtain the exact patch identifier and installation instructions for versions 15.0.0.0.0 and 15.2.0.0.0. As a compensating control prior to patching, restrict network access to the Prov IF HTTP interface to a minimal set of trusted administrative source IPs via perimeter firewall or host-based ACLs, reducing exposure to the AV:N attack vector. Additionally, enforce least-privilege principles on accounts with high-privilege access to the provisioning interface to raise the cost of credential compromise as a prerequisite. Note that network restriction does not eliminate the vulnerability but significantly narrows the attacker population.