This vulnerability affects Oracle Communications Convergent Charging Controller component Prov IF in versions 15.0.0.0.0 and 15.2.0.0.0. It requires a high privileged attacker with network access over HTTP and involves user interaction from a third party to exploit. The CVSS 3.1 vector (AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H) reflects network attack vector, high attack complexity, required privileges, and user interaction, with high impact on confidentiality, integrity, and availability. The vendor advisory from Oracle (July 2026 Critical Patch Update) does not explicitly confirm a patch or remediation level for this specific vulnerability but strongly encourages applying available patches promptly. No known exploits in the wild have been reported.

If successfully exploited, this vulnerability can lead to complete takeover of the Oracle Communications Convergent Charging Controller, affecting confidentiality, integrity, and availability of the system. However, exploitation is difficult and requires high privileges, network access via HTTP, and user interaction from a third party. No known active exploitation has been reported.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches without delay and remaining on actively supported versions. Until an official patch is confirmed, limit network exposure of the affected product and monitor for suspicious activity involving user interactions.