Oracle Communications CACS EUVD-2026-47422

Exploitation requires network (TCP/IP) reachability to the Oracle Communications Converged Application Server Core service on versions 8.2 or 8.3; no authentication (PR:N) and no user interaction (UI:N) are needed against a reachable instance. The primary limiting factor is high attack complexity (AC:H) - Oracle rates this 'difficult to exploit,' implying the attacker must overcome conditions outside their control (e.g., specific server state, race timing, or non-trivial protocol sequencing) rather than a single deterministic request. Exploitation is further bounded to the two affected versions (8.2, 8.3) and to deployments where the Core listener is network-accessible to the attacker; the exact triggering feature or protocol path is not specified in the available data.

This is a genuinely high-severity issue (CVSS 8.1) with the worst-case outcome - full server takeover - reachable without authentication (PR:N) or user interaction (UI:N) across the network. The key mitigating signal is AC:H: Oracle explicitly calls this 'difficult to exploit', meaning specialized conditions or timing outside attacker control are required, which lowers the practical likelihood relative to an AC:L bug of the same score. No EPSS score, no POC, and no CISA KEV listing are present in the provided data, so there is no evidence of active or imminent exploitation; the risk is currently theoretical-but-serious rather than under active attack. There is a mild internal tension worth flagging: the 'Information Disclosure' tag understates the CVSS-declared full-takeover (C:H/I:H/A:H) impact - treat the CVSS impact as authoritative. Because OCCAS is a telecom-facing, often internet-adjacent service handling SIP/HTTP traffic, exposed instances should be prioritized for patching despite the high exploit complexity.

An unauthenticated attacker who can reach the OCCAS Core service over TCP/IP sends a specially crafted sequence of network requests to the container's request-handling path, exploiting the flaw to gain control of the server. Because the CVSS vector is rated high-complexity (AC:H), the attacker likely must satisfy specific timing, state, or configuration preconditions to reliably trigger the bug. No public proof-of-concept is identified at time of analysis, so an attacker would need to independently develop the exploit.