NCSC-2026-0375
Vulnerability from csaf_ncscnl - Published: 2026-09-16 13:52 - Updated: 2026-09-16 13:52Summary
Kwetsbaarheden verholpen in Oracle Communications
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:
NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.
NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.
This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten: Oracle heeft 31 kwetsbaarheden verholpen in diverse Oracle Communications-producten, waaronder Oracle Communications Unified Assurance, Oracle Communications Cloud Native Core Security Edge Protection Proxy, Oracle Communications MetaSolv Solution Module - ASR, Oracle Communications Service Catalog and Design en Oracle Communications Operations Monitor.
Interpretaties: De kwetsbaarheden betreffen verschillende beveiligingsproblemen in Oracle Communications-producten, waaronder mogelijkheden voor niet-geauthenticeerde en laaggeprivilegieerde kwaadwillenden om via netwerktoegang ongeautoriseerde acties uit te voeren. De kwetsbaarheden hebben CVSS-scores variërend van laag tot kritiek. Van de in totaal 31 kwetsbaarheden zijn vier als kritiek aangemerkt en kunnen 23 kwetsbaarheden zonder authenticatie op afstand worden misbruikt. Succesvol misbruik kan onder meer leiden tot het verkrijgen van ongeautoriseerde toegang tot gevoelige informatie, het wijzigen van gegevens en het verstoren van de beschikbaarheid van getroffen systemen. Sommige kwetsbaarheden vereisen gebruikersinteractie of voorafgaande toegangsrechten, terwijl andere volledig op afstand en zonder authenticatie kunnen worden misbruikt.
De vier kwetsbaarheden die als kritiek zijn aangemerkt, CVE-2026-44024, CVE-2026-17544, CVE-2026-71290 en CVE-2026-73194, hebben een CVSS-score van 9,1 of hoger en bevinden zich in verschillende Core-componenten van Oracle Communications Unified Assurance, waaronder Fluentd, PHP, Apache HttpClient en DBI. Deze kwetsbaarheden kunnen zonder authenticatie op afstand worden misbruikt en kunnen een hoge impact hebben op de vertrouwelijkheid en, afhankelijk van de kwetsbaarheid, de integriteit en beschikbaarheid van getroffen systemen.
Het NCSC adviseert om de beveiligingsupdates voor de kritieke kwetsbaarheden met voorrang toe te passen.
Oplossingen: Oracle heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Kans: medium
Schade: high
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-59: Improper Link Resolution Before File Access ('Link Following')
CWE-61: UNIX Symbolic Link (Symlink) Following
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-116: Improper Encoding or Escaping of Output
CWE-129: Improper Validation of Array Index
CWE-130: Improper Handling of Length Parameter Inconsistency
CWE-131: Incorrect Calculation of Buffer Size
CWE-201: Insertion of Sensitive Information Into Sent Data
CWE-208: Observable Timing Discrepancy
CWE-209: Generation of Error Message Containing Sensitive Information
CWE-295: Improper Certificate Validation
CWE-297: Improper Validation of Certificate with Host Mismatch
CWE-404: Improper Resource Shutdown or Release
CWE-456: Missing Initialization of a Variable
CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
CWE-770: Allocation of Resources Without Limits or Throttling
CWE-772: Missing Release of Resource after Effective Lifetime
CWE-787: Out-of-bounds Write
CWE-789: Memory Allocation with Excessive Size Value
CWE-863: Incorrect Authorization
CWE-918: Server-Side Request Forgery (SSRF)
CWE-941: Incorrectly Specified Destination in a Communication Channel
CWE-1284: Improper Validation of Specified Quantity in Input
CWE-1286: Improper Validation of Syntactic Correctness of Input
CWE-1289: Improper Validation of Unsafe Equivalence in Input
Eclipse Parsson versions before 1.1.8 have a denial of service vulnerability due to lack of a maximum JSON character limit, affecting multiple Oracle and Red Hat products and allowing remote attackers to cause application hangs or crashes.
7.5 (High)
Affected products
Known affected
6 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Oracle Communications
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Console
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications MetaSolv Solution Module - ASR
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Operations Monitor
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Service Catalog and Design
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Unified Assurance
|
vers:unknown/* |
Body-parser versions prior to 1.20.6 and 2.3.0 allow denial of service via oversized payloads due to invalid limit option handling, while Oracle Communications Unified Assurance 6.1.1 to 7.0.0 contains a partial denial of service vulnerability exploitable by unauthenticated attackers.
5.9 (Medium)
Affected products
Known affected
6 products, the same list as for
CVE-2026-9563
Multiple vulnerabilities in logback-core up to versions 1.5.35/1.5.36 allow attackers with write access or environment variable injection capabilities to execute arbitrary code if the Janino library is present, alongside a separate Oracle Communications Unified Assurance vulnerability permitting high-privileged attackers to compromise system integrity.
6.0 (Medium)
Affected products
Known affected
6 products, the same list as for
CVE-2026-9563
CryptX for Perl before 0.088_001 has a timing side-channel vulnerability enabling AEAD tag forgery, while Oracle Communications Unified Assurance 6.1.1 to 7.0.0 contains a difficult-to-exploit HTTP-based partial denial of service vulnerability.
CWE-208 - Observable Timing DiscrepancyAffected products
Known affected
6 products, the same list as for
CVE-2026-9563
Multiple critical vulnerabilities affect PHP versions 8.4.* before 8.4.24, 8.5.* before 8.5.9, and Oracle Communications Unified Assurance 7.0.0, enabling remote attackers to cause memory corruption and potentially full system takeover.
9.8 (Critical)
Affected products
Known affected
6 products, the same list as for
CVE-2026-9563
A path-traversal vulnerability in Logback-classic (0.9.14 to 1.6.2) enables attackers to create and append log files outside intended directories, while Oracle Communications Unified Assurance 6.1.1 to 7.0.0 suffers an exploitable network vulnerability in its Core logback component allowing unauthorized data access.
6.5 (Medium)
Affected products
Known affected
6 products, the same list as for
CVE-2026-9563
An incomplete fix for CVE-2025-68161 in Apache Log4j left TLS hostname verification vulnerable via the <Ssl> element's ignored verifyHostName attribute, affecting multiple products including Oracle, IBM Db2, and SAP Commerce Cloud.
7.5 (High)
Affected products
Known affected
6 products, the same list as for
CVE-2026-9563
A vulnerability in Go's os.Root on Unix systems allows attackers to bypass directory restrictions by exploiting symlinks with trailing slashes, fixed in Go versions 1.25.12 and 1.26.5 (CVE-2026-39822), while Oracle Communications Unified Assurance 6.1.1-7.0.0 suffers a critical system takeover flaw.
7.8 (High)
Affected products
Known affected
6 products, the same list as for
CVE-2026-9563
Multiple vulnerabilities affect DOMPurify (v1.0.10 to <3.4.0) with XSS via template expression bypass, Oracle Primavera P6 (v21.12.0.0 to 25.12.6.0) and Oracle Communications Operations Monitor 6.1 with unauthorized access risks requiring user interaction.
6.8 (Medium)
Affected products
Known affected
6 products, the same list as for
CVE-2026-9563
Libgcrypt versions prior to 1.12.2 contain a heap-based buffer overflow vulnerability in gcry_pk_decrypt triggered by crafted ECDH ciphertext, leading to denial of service, with additional issues affecting Ubuntu 26.04 LTS and Oracle Communications products.
7.5 (High)
Affected products
Known affected
6 products, the same list as for
CVE-2026-9563
Fluentd versions prior to 1.19.3 and Oracle Communications Unified Assurance versions 6.1.1 to 7.0.0 contain critical vulnerabilities allowing arbitrary file write, remote code execution, and full system compromise via insufficient input validation and unauthenticated network access.
9.8 (Critical)
Affected products
Known affected
6 products, the same list as for
CVE-2026-9563
Guzzlehttp/psr7 versions prior to 2.10.2 improperly validate Host headers, allowing attackers to craft malformed values that cause URI host discrepancies, potentially leading to misrouting, credential leakage, and unauthorized data access in affected products including Oracle Communications Unified Assurance.
5.3 (Medium)
Affected products
Known affected
6 products, the same list as for
CVE-2026-9563
SimpleSAMLphp versions prior to 2.4.7, 2.5.2, and 1.18.6 have vulnerabilities in the SP ACS path that allow acceptance of SAML responses from unexpected IdPs, leading to authentication bypass and information disclosure, with Oracle Communications Unified Assurance 6.1.1 to 7.0.0 also affected by unauthorized data access via SimpleSAMLphp.
7.1 (High)
Affected products
Known affected
6 products, the same list as for
CVE-2026-9563
Apache Log4j versions 2.13.1 through 2.25.4 and 2.26.0 have vulnerabilities including improper JSON encoding of non-finite floating-point values and potential data modification risks, affecting Oracle products such as Autonomous Health Framework and Enterprise Manager with varying exploitability and severity.
5.9 (Medium)
Affected products
Known affected
6 products, the same list as for
CVE-2026-9563
An unauthenticated network attacker can exploit a vulnerability in Apache ActiveMQ's WireFormatInfo frame handling to cause out-of-memory errors and Denial of Service (DoS), affecting multiple versions including Oracle Communications Unified Assurance and Red Hat AMQ Broker.
7.5 (High)
Affected products
Known affected
6 products, the same list as for
CVE-2026-9563
A vulnerability in jackson-databind's UnwrappedPropertyHandler allows bypassing @JsonView restrictions to populate constructor parameters, with critical remote code execution flaws in Oracle products scoring up to 8.1 CVSS.
8.1 (High)
Affected products
Known affected
6 products, the same list as for
CVE-2026-9563
A vulnerability in Erlang/OTP's SSL application and Oracle Communications Unified Assurance allows unauthenticated attackers to cause denial of service by exploiting improper validation in TLS 1.3 ClientHello messages or triggering crashes, affecting session ticket handling and system stability.
7.5 (High)
Affected products
Known affected
6 products, the same list as for
CVE-2026-9563
RabbitMQ versions prior to 4.2.6 and Oracle Communications Unified Assurance 7.0.0 contain vulnerabilities allowing unauthenticated attackers to cause denial-of-service via oversized frames or HTTP requests, impacting memory and system stability.
7.5 (High)
Affected products
Known affected
6 products, the same list as for
CVE-2026-9563
The Wikimedia Foundation Mediawiki UrlShortener Extension has an open redirect vulnerability enabling Cross-Site Flashing in certain versions, while Oracle Communications Unified Assurance 6.1.1 to 7.0.0 contains an exploitable flaw allowing unauthenticated network attackers to read and modify data.
6.1 (Medium)
Affected products
Known affected
6 products, the same list as for
CVE-2026-9563
A vulnerability in Dompdf's SVG rendering component, affecting versions up to 3.15 and integrated in Oracle Communications Unified Assurance 6.1.1 to 7.0.0, allows unauthenticated attackers to leak filesystem information and cause partial denial of service.
6.5 (Medium)
Affected products
Known affected
6 products, the same list as for
CVE-2026-9563
Multiple vulnerabilities in Oracle MySQL Server, MySQL Cluster (versions 8.4.0-8.4.10, 9.7.0-9.7.1), and Oracle Communications Unified Assurance (versions 6.1.1-7.0.0) allow low-privileged attackers with network access to cause denial of service by hanging or crashing the systems.
6.5 (Medium)
Affected products
Known affected
6 products, the same list as for
CVE-2026-9563
Helm versions up to 4.2.3 have a denial of service vulnerability due to zero-length byte slices in chart files causing index out of range panics, while Oracle Communications Unified Assurance 7.0.0 is vulnerable to an easily exploitable partial denial of service by unauthenticated network attackers.
4.3 (Medium)
Affected products
Known affected
6 products, the same list as for
CVE-2026-9563
MLflow versions prior to 3.15.0 and Oracle Communications Unified Assurance versions 6.1.1 to 7.0.0 contain SSRF and unauthorized access vulnerabilities that expose internal or cloud metadata services and critical data via improper URL validation and redirect handling.
9.3 (Critical)
Affected products
Known affected
6 products, the same list as for
CVE-2026-9563
Multiple Apache Tomcat versions, including 9.0.89 to 9.0.120, 10.1.24 to 10.1.57, and 11.0.0 to 11.0.24, contain resource exhaustion vulnerabilities in the WebSocket chat example that can lead to Denial of Service conditions.
7.5 (High)
Affected products
Known affected
6 products, the same list as for
CVE-2026-9563
Guzzle versions before 7.15.1 improperly handle host-only cookies, exposing parent host cookies to child hosts, while Oracle Communications Unified Assurance versions 6.1.1-7.0.0 have a high-severity vulnerability in the Core (Guzzle) component allowing unauthenticated system takeover.
8.1 (High)
Affected products
Known affected
6 products, the same list as for
CVE-2026-9563
Apache HttpComponents Client versions 5.4 to 5.6.4 and Oracle Communications Unified Assurance 6.1.1 to 7.0.0 contain critical vulnerabilities in asynchronous HttpClient's TLS hostname verification, enabling remote attackers to impersonate servers and gain unauthorized access.
9.1 (Critical)
Affected products
Known affected
6 products, the same list as for
CVE-2026-9563
Perl DBI versions before 1.652 contain a heap out-of-bounds write vulnerability due to an unvalidated numeric placeholder causing buffer overflow, while Oracle Communications Unified Assurance versions 6.1.1 to 7.0.0 have a critical remote vulnerability allowing unauthenticated access or denial of service via HTTP.
9.1 (Critical)
Affected products
Known affected
6 products, the same list as for
CVE-2026-9563
Netty versions prior to 4.1.136.Final and 4.2.16.Final contain a memory leak vulnerability in DNS record handling that can be exploited by unauthenticated remote attackers to cause denial of service, also affecting Oracle Communications Service Catalog and Design 8.0-8.1 via a third-party Netty component.
7.5 (High)
Affected products
Known affected
6 products, the same list as for
CVE-2026-9563
A vulnerability in Oracle Communications Cloud Native Core Security Edge Protection Proxy (versions 26.1.200 and 25.2.201) allows unauthenticated attackers with physical network access to compromise the system, rated CVSS 7.1.
7.1 (High)
Affected products
Known affected
6 products, the same list as for
CVE-2026-9563
A vulnerability in Oracle Communications Cloud Native Core Security Edge Protection Proxy (versions 26.1.200 and 25.2.201) allows low-privileged attackers with HTTP network access to gain unauthorized modification of critical data, rated CVSS 8.2.
8.2 (High)
Affected products
Known affected
6 products, the same list as for
CVE-2026-9563
A vulnerability in Oracle Communications Cloud Native Core Security Edge Protection Proxy (versions 26.1.200 and 25.2.201) allows a low-privileged attacker with HTTP network access to gain unauthorized read and write access to certain data, rated CVSS 5.4.
5.4 (Medium)
Affected products
Known affected
6 products, the same list as for
CVE-2026-9563
References
32 references
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE"
}
},
"lang": "nl",
"notes": [
{
"category": "legal_disclaimer",
"text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
},
{
"category": "description",
"text": "Oracle heeft 31 kwetsbaarheden verholpen in diverse Oracle Communications-producten, waaronder Oracle Communications Unified Assurance, Oracle Communications Cloud Native Core Security Edge Protection Proxy, Oracle Communications MetaSolv Solution Module - ASR, Oracle Communications Service Catalog and Design en Oracle Communications Operations Monitor.",
"title": "Feiten"
},
{
"category": "description",
"text": "De kwetsbaarheden betreffen verschillende beveiligingsproblemen in Oracle Communications-producten, waaronder mogelijkheden voor niet-geauthenticeerde en laaggeprivilegieerde kwaadwillenden om via netwerktoegang ongeautoriseerde acties uit te voeren. De kwetsbaarheden hebben CVSS-scores vari\u00ebrend van laag tot kritiek. Van de in totaal 31 kwetsbaarheden zijn vier als kritiek aangemerkt en kunnen 23 kwetsbaarheden zonder authenticatie op afstand worden misbruikt. Succesvol misbruik kan onder meer leiden tot het verkrijgen van ongeautoriseerde toegang tot gevoelige informatie, het wijzigen van gegevens en het verstoren van de beschikbaarheid van getroffen systemen. Sommige kwetsbaarheden vereisen gebruikersinteractie of voorafgaande toegangsrechten, terwijl andere volledig op afstand en zonder authenticatie kunnen worden misbruikt.\n\nDe vier kwetsbaarheden die als kritiek zijn aangemerkt, CVE-2026-44024, CVE-2026-17544, CVE-2026-71290 en CVE-2026-73194, hebben een CVSS-score van 9,1 of hoger en bevinden zich in verschillende Core-componenten van Oracle Communications Unified Assurance, waaronder Fluentd, PHP, Apache HttpClient en DBI. Deze kwetsbaarheden kunnen zonder authenticatie op afstand worden misbruikt en kunnen een hoge impact hebben op de vertrouwelijkheid en, afhankelijk van de kwetsbaarheid, de integriteit en beschikbaarheid van getroffen systemen.\n\nHet NCSC adviseert om de beveiligingsupdates voor de kritieke kwetsbaarheden met voorrang toe te passen.",
"title": "Interpretaties"
},
{
"category": "description",
"text": "Oracle heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
"title": "Oplossingen"
},
{
"category": "general",
"text": "medium",
"title": "Kans"
},
{
"category": "general",
"text": "high",
"title": "Schade"
},
{
"category": "general",
"text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"title": "CWE-22"
},
{
"category": "general",
"text": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"title": "CWE-59"
},
{
"category": "general",
"text": "UNIX Symbolic Link (Symlink) Following",
"title": "CWE-61"
},
{
"category": "general",
"text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"title": "CWE-79"
},
{
"category": "general",
"text": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"title": "CWE-94"
},
{
"category": "general",
"text": "Improper Encoding or Escaping of Output",
"title": "CWE-116"
},
{
"category": "general",
"text": "Improper Validation of Array Index",
"title": "CWE-129"
},
{
"category": "general",
"text": "Improper Handling of Length Parameter Inconsistency",
"title": "CWE-130"
},
{
"category": "general",
"text": "Incorrect Calculation of Buffer Size",
"title": "CWE-131"
},
{
"category": "general",
"text": "Insertion of Sensitive Information Into Sent Data",
"title": "CWE-201"
},
{
"category": "general",
"text": "Observable Timing Discrepancy",
"title": "CWE-208"
},
{
"category": "general",
"text": "Generation of Error Message Containing Sensitive Information",
"title": "CWE-209"
},
{
"category": "general",
"text": "Improper Certificate Validation",
"title": "CWE-295"
},
{
"category": "general",
"text": "Improper Validation of Certificate with Host Mismatch",
"title": "CWE-297"
},
{
"category": "general",
"text": "Improper Resource Shutdown or Release",
"title": "CWE-404"
},
{
"category": "general",
"text": "Missing Initialization of a Variable",
"title": "CWE-456"
},
{
"category": "general",
"text": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"title": "CWE-601"
},
{
"category": "general",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
},
{
"category": "general",
"text": "Missing Release of Resource after Effective Lifetime",
"title": "CWE-772"
},
{
"category": "general",
"text": "Out-of-bounds Write",
"title": "CWE-787"
},
{
"category": "general",
"text": "Memory Allocation with Excessive Size Value",
"title": "CWE-789"
},
{
"category": "general",
"text": "Incorrect Authorization",
"title": "CWE-863"
},
{
"category": "general",
"text": "Server-Side Request Forgery (SSRF)",
"title": "CWE-918"
},
{
"category": "general",
"text": "Incorrectly Specified Destination in a Communication Channel",
"title": "CWE-941"
},
{
"category": "general",
"text": "Improper Validation of Specified Quantity in Input",
"title": "CWE-1284"
},
{
"category": "general",
"text": "Improper Validation of Syntactic Correctness of Input",
"title": "CWE-1286"
},
{
"category": "general",
"text": "Improper Validation of Unsafe Equivalence in Input",
"title": "CWE-1289"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "cert@ncsc.nl",
"name": "Nationaal Cyber Security Centrum",
"namespace": "https://www.ncsc.nl/"
},
"references": [
{
"category": "external",
"summary": "Reference",
"url": "https://www.oracle.com/security-alerts/cspusep2026.html"
}
],
"title": "Kwetsbaarheden verholpen in Oracle Communications",
"tracking": {
"current_release_date": "2026-09-16T13:52:22.718707Z",
"generator": {
"date": "2025-08-04T16:30:00Z",
"engine": {
"name": "V.A.",
"version": "1.3"
}
},
"id": "NCSC-2026-0375",
"initial_release_date": "2026-09-16T13:52:22.718707Z",
"revision_history": [
{
"date": "2026-09-16T13:52:22.718707Z",
"number": "1.0.0",
"summary": "Initiele versie"
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-1"
}
}
],
"category": "product_name",
"name": "Oracle Communications"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-2"
}
}
],
"category": "product_name",
"name": "Oracle Communications Cloud Native Core Console"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-3"
}
}
],
"category": "product_name",
"name": "Oracle Communications MetaSolv Solution Module - ASR"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-4"
}
}
],
"category": "product_name",
"name": "Oracle Communications Operations Monitor"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-5"
}
}
],
"category": "product_name",
"name": "Oracle Communications Service Catalog and Design"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-6"
}
}
],
"category": "product_name",
"name": "Oracle Communications Unified Assurance"
}
],
"category": "vendor",
"name": "Oracle"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-9563",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"notes": [
{
"category": "other",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
},
{
"category": "description",
"text": "Eclipse Parsson versions before 1.1.8 have a denial of service vulnerability due to lack of a maximum JSON character limit, affecting multiple Oracle and Red Hat products and allowing remote attackers to cause application hangs or crashes.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-9563 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-9563.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
}
],
"title": "CVE-2026-9563"
},
{
"cve": "CVE-2026-12590",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"notes": [
{
"category": "other",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
},
{
"category": "description",
"text": "Body-parser versions prior to 1.20.6 and 2.3.0 allow denial of service via oversized payloads due to invalid limit option handling, while Oracle Communications Unified Assurance 6.1.1 to 7.0.0 contains a partial denial of service vulnerability exploitable by unauthenticated attackers.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-12590 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-12590.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
}
],
"title": "CVE-2026-12590"
},
{
"cve": "CVE-2026-13006",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"title": "CWE-94"
},
{
"category": "description",
"text": "Multiple vulnerabilities in logback-core up to versions 1.5.35/1.5.36 allow attackers with write access or environment variable injection capabilities to execute arbitrary code if the Janino library is present, alongside a separate Oracle Communications Unified Assurance vulnerability permitting high-privileged attackers to compromise system integrity.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/S:P/AU:N/RE:M/U:Green",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-13006 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-13006.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.0,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
}
],
"title": "CVE-2026-13006"
},
{
"cve": "CVE-2026-13758",
"cwe": {
"id": "CWE-208",
"name": "Observable Timing Discrepancy"
},
"notes": [
{
"category": "other",
"text": "Observable Timing Discrepancy",
"title": "CWE-208"
},
{
"category": "description",
"text": "CryptX for Perl before 0.088_001 has a timing side-channel vulnerability enabling AEAD tag forgery, while Oracle Communications Unified Assurance 6.1.1 to 7.0.0 contains a difficult-to-exploit HTTP-based partial denial of service vulnerability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-13758 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-13758.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
}
],
"title": "CVE-2026-13758"
},
{
"cve": "CVE-2026-17544",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "other",
"text": "Out-of-bounds Write",
"title": "CWE-787"
},
{
"category": "description",
"text": "Multiple critical vulnerabilities affect PHP versions 8.4.* before 8.4.24, 8.5.* before 8.5.9, and Oracle Communications Unified Assurance 7.0.0, enabling remote attackers to cause memory corruption and potentially full system takeover.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-17544 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-17544.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
}
],
"title": "CVE-2026-17544"
},
{
"cve": "CVE-2026-19880",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"title": "CWE-22"
},
{
"category": "description",
"text": "A path-traversal vulnerability in Logback-classic (0.9.14 to 1.6.2) enables attackers to create and append log files outside intended directories, while Oracle Communications Unified Assurance 6.1.1 to 7.0.0 suffers an exploitable network vulnerability in its Core logback component allowing unauthorized data access.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/S:P/AU:N/RE:M/U:Green",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-19880 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-19880.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
}
],
"title": "CVE-2026-19880"
},
{
"cve": "CVE-2026-34477",
"cwe": {
"id": "CWE-297",
"name": "Improper Validation of Certificate with Host Mismatch"
},
"notes": [
{
"category": "other",
"text": "Improper Validation of Certificate with Host Mismatch",
"title": "CWE-297"
},
{
"category": "other",
"text": "Improper Certificate Validation",
"title": "CWE-295"
},
{
"category": "description",
"text": "An incomplete fix for CVE-2025-68161 in Apache Log4j left TLS hostname verification vulnerable via the \u003cSsl\u003e element\u0027s ignored verifyHostName attribute, affecting multiple products including Oracle, IBM Db2, and SAP Commerce Cloud.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-34477 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-34477.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
}
],
"title": "CVE-2026-34477"
},
{
"cve": "CVE-2026-39822",
"cwe": {
"id": "CWE-61",
"name": "UNIX Symbolic Link (Symlink) Following"
},
"notes": [
{
"category": "other",
"text": "UNIX Symbolic Link (Symlink) Following",
"title": "CWE-61"
},
{
"category": "other",
"text": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"title": "CWE-59"
},
{
"category": "description",
"text": "A vulnerability in Go\u0027s os.Root on Unix systems allows attackers to bypass directory restrictions by exploiting symlinks with trailing slashes, fixed in Go versions 1.25.12 and 1.26.5 (CVE-2026-39822), while Oracle Communications Unified Assurance 6.1.1-7.0.0 suffers a critical system takeover flaw.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-39822 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-39822.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
}
],
"title": "CVE-2026-39822"
},
{
"cve": "CVE-2026-41239",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"notes": [
{
"category": "other",
"text": "Improper Validation of Unsafe Equivalence in Input",
"title": "CWE-1289"
},
{
"category": "other",
"text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"title": "CWE-79"
},
{
"category": "description",
"text": "Multiple vulnerabilities affect DOMPurify (v1.0.10 to \u003c3.4.0) with XSS via template expression bypass, Oracle Primavera P6 (v21.12.0.0 to 25.12.6.0) and Oracle Communications Operations Monitor 6.1 with unauthorized access risks requiring user interaction.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-41239 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-41239.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
}
],
"title": "CVE-2026-41239"
},
{
"cve": "CVE-2026-41989",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "other",
"text": "Out-of-bounds Write",
"title": "CWE-787"
},
{
"category": "other",
"text": "Incorrect Calculation of Buffer Size",
"title": "CWE-131"
},
{
"category": "description",
"text": "Libgcrypt versions prior to 1.12.2 contain a heap-based buffer overflow vulnerability in gcry_pk_decrypt triggered by crafted ECDH ciphertext, leading to denial of service, with additional issues affecting Ubuntu 26.04 LTS and Oracle Communications products.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-41989 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-41989.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
}
],
"title": "CVE-2026-41989"
},
{
"cve": "CVE-2026-44024",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"title": "CWE-22"
},
{
"category": "other",
"text": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"title": "CWE-94"
},
{
"category": "description",
"text": "Fluentd versions prior to 1.19.3 and Oracle Communications Unified Assurance versions 6.1.1 to 7.0.0 contain critical vulnerabilities allowing arbitrary file write, remote code execution, and full system compromise via insufficient input validation and unauthenticated network access.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-44024 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-44024.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
}
],
"title": "CVE-2026-44024"
},
{
"cve": "CVE-2026-48998",
"cwe": {
"id": "CWE-918",
"name": "Server-Side Request Forgery (SSRF)"
},
"notes": [
{
"category": "other",
"text": "Server-Side Request Forgery (SSRF)",
"title": "CWE-918"
},
{
"category": "other",
"text": "Improper Validation of Syntactic Correctness of Input",
"title": "CWE-1286"
},
{
"category": "description",
"text": "Guzzlehttp/psr7 versions prior to 2.10.2 improperly validate Host headers, allowing attackers to craft malformed values that cause URI host discrepancies, potentially leading to misrouting, credential leakage, and unauthorized data access in affected products including Oracle Communications Unified Assurance.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-48998 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-48998.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
}
],
"title": "CVE-2026-48998"
},
{
"cve": "CVE-2026-49284",
"notes": [
{
"category": "description",
"text": "SimpleSAMLphp versions prior to 2.4.7, 2.5.2, and 1.18.6 have vulnerabilities in the SP ACS path that allow acceptance of SAML responses from unexpected IdPs, leading to authentication bypass and information disclosure, with Oracle Communications Unified Assurance 6.1.1 to 7.0.0 also affected by unauthorized data access via SimpleSAMLphp.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-49284 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-49284.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
}
],
"title": "CVE-2026-49284"
},
{
"cve": "CVE-2026-49844",
"cwe": {
"id": "CWE-116",
"name": "Improper Encoding or Escaping of Output"
},
"notes": [
{
"category": "other",
"text": "Improper Encoding or Escaping of Output",
"title": "CWE-116"
},
{
"category": "description",
"text": "Apache Log4j versions 2.13.1 through 2.25.4 and 2.26.0 have vulnerabilities including improper JSON encoding of non-finite floating-point values and potential data modification risks, affecting Oracle products such as Autonomous Health Framework and Enterprise Manager with varying exploitability and severity.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-49844 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-49844.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
}
],
"title": "CVE-2026-49844"
},
{
"cve": "CVE-2026-50734",
"cwe": {
"id": "CWE-789",
"name": "Memory Allocation with Excessive Size Value"
},
"notes": [
{
"category": "other",
"text": "Memory Allocation with Excessive Size Value",
"title": "CWE-789"
},
{
"category": "other",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
},
{
"category": "description",
"text": "An unauthenticated network attacker can exploit a vulnerability in Apache ActiveMQ\u0027s WireFormatInfo frame handling to cause out-of-memory errors and Denial of Service (DoS), affecting multiple versions including Oracle Communications Unified Assurance and Red Hat AMQ Broker.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-50734 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-50734.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
}
],
"title": "CVE-2026-50734"
},
{
"cve": "CVE-2026-54518",
"cwe": {
"id": "CWE-863",
"name": "Incorrect Authorization"
},
"notes": [
{
"category": "other",
"text": "Incorrect Authorization",
"title": "CWE-863"
},
{
"category": "description",
"text": "A vulnerability in jackson-databind\u0027s UnwrappedPropertyHandler allows bypassing @JsonView restrictions to populate constructor parameters, with critical remote code execution flaws in Oracle products scoring up to 8.1 CVSS.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-54518 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-54518.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
}
],
"title": "CVE-2026-54518"
},
{
"cve": "CVE-2026-55952",
"cwe": {
"id": "CWE-1284",
"name": "Improper Validation of Specified Quantity in Input"
},
"notes": [
{
"category": "other",
"text": "Improper Validation of Specified Quantity in Input",
"title": "CWE-1284"
},
{
"category": "other",
"text": "Improper Handling of Length Parameter Inconsistency",
"title": "CWE-130"
},
{
"category": "description",
"text": "A vulnerability in Erlang/OTP\u0027s SSL application and Oracle Communications Unified Assurance allows unauthenticated attackers to cause denial of service by exploiting improper validation in TLS 1.3 ClientHello messages or triggering crashes, affecting session ticket handling and system stability.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-55952 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-55952.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
}
],
"title": "CVE-2026-55952"
},
{
"cve": "CVE-2026-57220",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"notes": [
{
"category": "other",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
},
{
"category": "description",
"text": "RabbitMQ versions prior to 4.2.6 and Oracle Communications Unified Assurance 7.0.0 contain vulnerabilities allowing unauthenticated attackers to cause denial-of-service via oversized frames or HTTP requests, impacting memory and system stability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-57220 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-57220.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
}
],
"title": "CVE-2026-57220"
},
{
"cve": "CVE-2026-58520",
"cwe": {
"id": "CWE-601",
"name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)"
},
"notes": [
{
"category": "other",
"text": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"title": "CWE-601"
},
{
"category": "description",
"text": "The Wikimedia Foundation Mediawiki UrlShortener Extension has an open redirect vulnerability enabling Cross-Site Flashing in certain versions, while Oracle Communications Unified Assurance 6.1.1 to 7.0.0 contains an exploitable flaw allowing unauthenticated network attackers to read and modify data.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-58520 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58520.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
}
],
"title": "CVE-2026-58520"
},
{
"cve": "CVE-2026-59943",
"cwe": {
"id": "CWE-209",
"name": "Generation of Error Message Containing Sensitive Information"
},
"notes": [
{
"category": "other",
"text": "Generation of Error Message Containing Sensitive Information",
"title": "CWE-209"
},
{
"category": "description",
"text": "A vulnerability in Dompdf\u0027s SVG rendering component, affecting versions up to 3.15 and integrated in Oracle Communications Unified Assurance 6.1.1 to 7.0.0, allows unauthenticated attackers to leak filesystem information and cause partial denial of service.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-59943 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-59943.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
}
],
"title": "CVE-2026-59943"
},
{
"cve": "CVE-2026-61109",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"notes": [
{
"category": "other",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
},
{
"category": "description",
"text": "Multiple vulnerabilities in Oracle MySQL Server, MySQL Cluster (versions 8.4.0-8.4.10, 9.7.0-9.7.1), and Oracle Communications Unified Assurance (versions 6.1.1-7.0.0) allow low-privileged attackers with network access to cause denial of service by hanging or crashing the systems.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61109 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61109.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
}
],
"title": "CVE-2026-61109"
},
{
"cve": "CVE-2026-63308",
"cwe": {
"id": "CWE-129",
"name": "Improper Validation of Array Index"
},
"notes": [
{
"category": "other",
"text": "Improper Validation of Array Index",
"title": "CWE-129"
},
{
"category": "description",
"text": "Helm versions up to 4.2.3 have a denial of service vulnerability due to zero-length byte slices in chart files causing index out of range panics, while Oracle Communications Unified Assurance 7.0.0 is vulnerable to an easily exploitable partial denial of service by unauthenticated network attackers.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-63308 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-63308.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
}
],
"title": "CVE-2026-63308"
},
{
"cve": "CVE-2026-64849",
"cwe": {
"id": "CWE-918",
"name": "Server-Side Request Forgery (SSRF)"
},
"notes": [
{
"category": "other",
"text": "Server-Side Request Forgery (SSRF)",
"title": "CWE-918"
},
{
"category": "description",
"text": "MLflow versions prior to 3.15.0 and Oracle Communications Unified Assurance versions 6.1.1 to 7.0.0 contain SSRF and unauthorized access vulnerabilities that expose internal or cloud metadata services and critical data via improper URL validation and redirect handling.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-64849 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64849.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
}
],
"title": "CVE-2026-64849"
},
{
"cve": "CVE-2026-66299",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"notes": [
{
"category": "other",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
},
{
"category": "description",
"text": "Multiple Apache Tomcat versions, including 9.0.89 to 9.0.120, 10.1.24 to 10.1.57, and 11.0.0 to 11.0.24, contain resource exhaustion vulnerabilities in the WebSocket chat example that can lead to Denial of Service conditions.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-66299 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-66299.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
}
],
"title": "CVE-2026-66299"
},
{
"cve": "CVE-2026-67355",
"cwe": {
"id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
},
"notes": [
{
"category": "other",
"text": "Insertion of Sensitive Information Into Sent Data",
"title": "CWE-201"
},
{
"category": "other",
"text": "Incorrectly Specified Destination in a Communication Channel",
"title": "CWE-941"
},
{
"category": "description",
"text": "Guzzle versions before 7.15.1 improperly handle host-only cookies, exposing parent host cookies to child hosts, while Oracle Communications Unified Assurance versions 6.1.1-7.0.0 have a high-severity vulnerability in the Core (Guzzle) component allowing unauthenticated system takeover.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-67355 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-67355.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
}
],
"title": "CVE-2026-67355"
},
{
"cve": "CVE-2026-71290",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"notes": [
{
"category": "other",
"text": "Improper Certificate Validation",
"title": "CWE-295"
},
{
"category": "description",
"text": "Apache HttpComponents Client versions 5.4 to 5.6.4 and Oracle Communications Unified Assurance 6.1.1 to 7.0.0 contain critical vulnerabilities in asynchronous HttpClient\u0027s TLS hostname verification, enabling remote attackers to impersonate servers and gain unauthorized access.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-71290 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-71290.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
}
],
"title": "CVE-2026-71290"
},
{
"cve": "CVE-2026-73194",
"cwe": {
"id": "CWE-1284",
"name": "Improper Validation of Specified Quantity in Input"
},
"notes": [
{
"category": "other",
"text": "Improper Validation of Specified Quantity in Input",
"title": "CWE-1284"
},
{
"category": "other",
"text": "Out-of-bounds Write",
"title": "CWE-787"
},
{
"category": "description",
"text": "Perl DBI versions before 1.652 contain a heap out-of-bounds write vulnerability due to an unvalidated numeric placeholder causing buffer overflow, while Oracle Communications Unified Assurance versions 6.1.1 to 7.0.0 have a critical remote vulnerability allowing unauthenticated access or denial of service via HTTP.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73194 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73194.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
}
],
"title": "CVE-2026-73194"
},
{
"cve": "CVE-2026-73508",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"notes": [
{
"category": "other",
"text": "Missing Release of Resource after Effective Lifetime",
"title": "CWE-772"
},
{
"category": "description",
"text": "Netty versions prior to 4.1.136.Final and 4.2.16.Final contain a memory leak vulnerability in DNS record handling that can be exploited by unauthenticated remote attackers to cause denial of service, also affecting Oracle Communications Service Catalog and Design 8.0-8.1 via a third-party Netty component.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73508 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73508.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
}
],
"title": "CVE-2026-73508"
},
{
"cve": "CVE-2026-83417",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Communications Cloud Native Core Security Edge Protection Proxy (versions 26.1.200 and 25.2.201) allows unauthenticated attackers with physical network access to compromise the system, rated CVSS 7.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83417 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83417.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
}
],
"title": "CVE-2026-83417"
},
{
"cve": "CVE-2026-83418",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Communications Cloud Native Core Security Edge Protection Proxy (versions 26.1.200 and 25.2.201) allows low-privileged attackers with HTTP network access to gain unauthorized modification of critical data, rated CVSS 8.2.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83418 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83418.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
}
],
"title": "CVE-2026-83418"
},
{
"cve": "CVE-2026-83419",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Communications Cloud Native Core Security Edge Protection Proxy (versions 26.1.200 and 25.2.201) allows a low-privileged attacker with HTTP network access to gain unauthorized read and write access to certain data, rated CVSS 5.4.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83419 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83419.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6"
]
}
],
"title": "CVE-2026-83419"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…