CVE-2026-61143

Katalog CVE

CVSS 6.4 · Medium EPSS 0,31%

Kerentanan Improper Access Control pada oracle communications convergent charging controller. Skor CVSS 3.1 6.4 (Medium) menurut oracle.com.

Deskripsi (NVD)

Vulnerability in the Oracle Communications Convergent Charging Controller product of Oracle Communications (component: Prov IF). Supported versions that are affected are 15.0.0.0.0 and 15.2.0.0.0. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Communications Convergent Charging Controller. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Communications Convergent Charging Controller. CVSS 3.1 Base Score 6.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H).

Rincian

Terbit di NVD

21 Juli 2026

Terakhir diubah

17 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

6.4 (Medium), sumber oracle.com
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control
CWE-304: Missing Critical Step in Authentication
CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
CWE-640: Weak Password Recovery Mechanism for Forgotten Password

EPSS (30 hari)

0,31% peluang dieksploitasi; lebih tinggi dari 22,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.oracle.com/security-alerts/cpujul2026.html advisory vendor