This vulnerability affects Oracle Communications Cloud Native Core Security Edge Protection Proxy versions 25.2.201 and 26.1.200. It permits a low privileged attacker with network access via HTTP to gain unauthorized update, insert, delete, and read access to certain accessible data within the product. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) reflects network attack vector, low attack complexity, low privilege required, no user interaction, unchanged scope, and limited confidentiality and integrity impacts. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which contains targeted security fixes for this and many other vulnerabilities.

Successful exploitation allows unauthorized read and write access to some data accessible by the Oracle Communications Cloud Native Core Security Edge Protection Proxy, potentially compromising confidentiality and integrity of that data. There is no reported impact on availability. The vulnerability requires network access via HTTP and low privileges, making it relatively easy to exploit within those constraints.

Oracle has released a Critical Security Patch Update in September 2026 that addresses this vulnerability. Customers are strongly advised to apply the provided security patches promptly to remediate this issue. Oracle recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.