This vulnerability affects Oracle Communications Cloud Native Core Security Edge Protection Proxy versions 25.2.201 and 26.1.200. It permits a low privileged attacker with network access via HTTP to compromise the product, resulting in unauthorized creation, deletion, or modification of critical data. The vulnerability impacts confidentiality and integrity with a CVSS 3.1 score of 8.2 (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N). While exploitation is difficult due to high attack complexity, successful attacks can also affect additional Oracle Communications products due to scope change. Oracle has included a fix for this vulnerability in its September 2026 Critical Security Patch Update and urges customers to apply patches without delay.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Communications Cloud Native Core Security Edge Protection Proxy. The vulnerability affects confidentiality and integrity but does not impact availability. Due to scope change, attacks may also significantly impact other Oracle Communications products. The vulnerability requires network access via HTTP and a low privileged attacker, with high attack complexity.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers should apply the official patches promptly to remediate the issue. Oracle strongly recommends remaining on actively-supported versions and applying security patches without delay to prevent exploitation. No alternative mitigations or workarounds are specified in the advisory.