Communications Converged Application Server
Monthly
Takeover of Oracle Communications Converged Application Server 8.3 is possible via a flaw in its RTP Proxy component, exploitable only by a high-privileged attacker with local logon to the host where the server runs. The CVSS 3.1 vector (AV:L/AC:H/PR:H/S:C) reflects difficult exploitation requiring existing elevated access, but a scope change means a successful attack can impact additional products beyond the server itself, with full confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; it was disclosed in Oracle's July 2026 Critical Patch Update.
Full server takeover in Oracle Communications Converged Application Server 8.2 and 8.3 (Core component) is possible for an unauthenticated remote attacker over TCP/IP, per Oracle's July 2026 Critical Patch Update. Successful attacks yield high confidentiality, integrity, and availability impact (CVSS 3.1 8.1), but the attack is rated high-complexity (AC:H), meaning exploitation requires conditions outside the attacker's direct control. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV, indicating no confirmed active exploitation.
Full compromise (takeover) of Oracle Communications Converged Application Server 8.3 is possible via its Security component, where a high-privileged attacker with TLS network access can achieve confidentiality, integrity, and availability loss that also crosses a trust boundary to affect additional products (scope change). CVSS 3.1 scores this 8.0 despite high attack complexity and a high-privilege prerequisite. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; no EPSS value was supplied.
Full takeover of Oracle Communications Converged Application Server 8.2 and 8.3 is possible for a remote, unauthenticated attacker over TCP/IP, per Oracle's July 2026 Critical Patch Update. Rated CVSS 3.1 9.0 with a scope change (S:C), a successful attack can compromise confidentiality, integrity, and availability of the server and significantly impact additional connected products, though high attack complexity (AC:H) makes exploitation non-trivial. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Vulnerability in the Oracle Communications Converged Application Server product of Oracle Communications (component: Core). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.
Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart requests. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable.
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Takeover of Oracle Communications Converged Application Server 8.3 is possible via a flaw in its RTP Proxy component, exploitable only by a high-privileged attacker with local logon to the host where the server runs. The CVSS 3.1 vector (AV:L/AC:H/PR:H/S:C) reflects difficult exploitation requiring existing elevated access, but a scope change means a successful attack can impact additional products beyond the server itself, with full confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; it was disclosed in Oracle's July 2026 Critical Patch Update.
Full server takeover in Oracle Communications Converged Application Server 8.2 and 8.3 (Core component) is possible for an unauthenticated remote attacker over TCP/IP, per Oracle's July 2026 Critical Patch Update. Successful attacks yield high confidentiality, integrity, and availability impact (CVSS 3.1 8.1), but the attack is rated high-complexity (AC:H), meaning exploitation requires conditions outside the attacker's direct control. No public exploit identified at time of analysis and the flaw is not listed in CISA KEV, indicating no confirmed active exploitation.
Full compromise (takeover) of Oracle Communications Converged Application Server 8.3 is possible via its Security component, where a high-privileged attacker with TLS network access can achieve confidentiality, integrity, and availability loss that also crosses a trust boundary to affect additional products (scope change). CVSS 3.1 scores this 8.0 despite high attack complexity and a high-privilege prerequisite. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; no EPSS value was supplied.
Full takeover of Oracle Communications Converged Application Server 8.2 and 8.3 is possible for a remote, unauthenticated attacker over TCP/IP, per Oracle's July 2026 Critical Patch Update. Rated CVSS 3.1 9.0 with a scope change (S:C), a successful attack can compromise confidentiality, integrity, and availability of the server and significantly impact additional connected products, though high attack complexity (AC:H) makes exploitation non-trivial. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Vulnerability in the Oracle Communications Converged Application Server product of Oracle Communications (component: Core). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Authorization vulnerability could allow attackers to bypass authorization checks to access restricted resources.
Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart requests. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable.
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.