This vulnerability affects Oracle Communications Cloud Native Core Security Edge Protection Proxy versions 25.2.201 and 26.1.200. An unauthenticated attacker who has access to the physical communication segment connected to the hardware where the proxy executes can exploit this flaw to gain unauthorized access to critical data and perform unauthorized insert, update, or delete operations on some accessible data. The CVSS 3.1 vector is AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, reflecting that the attack requires adjacent network access, low attack complexity, no privileges or user interaction, and impacts confidentiality and integrity but not availability. Oracle has included this fix in their September 2026 Critical Security Patch Update.

Exploitation of this vulnerability can result in unauthorized disclosure of critical data (high confidentiality impact) and limited unauthorized modification of some data (low integrity impact) within the Oracle Communications Cloud Native Core Security Edge Protection Proxy environment. There is no impact on availability. The attacker must have physical network segment access but does not require authentication or user interaction.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers running affected versions 25.2.201 and 26.1.200 should apply the relevant patches provided by Oracle without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches to mitigate this and other vulnerabilities. Patch status is confirmed by the vendor advisory. No alternative mitigations or workarounds are specified.