This vulnerability in Oracle Communications Service Catalog and Design affects versions from 8.0.0.7.0 up to 8.3.0.2.0. It is easily exploitable by an attacker with low privileges who has network access via HTTP, enabling compromise and potential takeover of the affected product. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory references multiple patches but does not explicitly confirm patch availability or remediation level for this specific vulnerability and version. Customers are urged to apply patches promptly as per Oracle's general guidance.

Successful exploitation can lead to complete compromise of Oracle Communications Service Catalog and Design, impacting confidentiality, integrity, and availability of the system. This could allow attackers to take over the affected product, potentially leading to unauthorized access and control over sensitive communications service catalog and design data.

Oracle's July 2026 Critical Patch Update advisory recommends applying security patches without delay and staying on actively supported versions. However, explicit patch availability or remediation status for this vulnerability and affected versions is not confirmed in the advisory content provided. Users should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch information and apply any relevant updates promptly. Until patches are applied, restrict network access to the affected service and monitor for suspicious activity related to this product.