CVE-2026-83418 is a vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy (SEPP) component that allows a low privileged attacker with network access via HTTP to compromise the product. The vulnerability affects versions 25.2.201 and 26.1.200. Exploitation can result in unauthorized creation, deletion, or modification of critical data, with significant confidentiality and integrity impacts. The CVSS 3.1 vector is AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N, yielding a base score of 8.2. Oracle has included a fix for this vulnerability in their September 2026 Critical Security Patch Update, which contains 673 security patches across multiple products.

The vulnerability allows unauthorized creation, deletion, or modification of critical data within Oracle Communications Cloud Native Core Security Edge Protection Proxy, potentially compromising confidentiality and integrity of all accessible data. The scope of impact may extend to additional Oracle Communications products. The CVSS score of 8.2 reflects a high severity with network attack vector, requiring low privileges but high attack complexity.

Oracle has released security patches for this vulnerability in the September 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patches promptly to mitigate the risk. Remaining on actively supported versions and timely patching are critical, as Oracle reports attempts to exploit vulnerabilities for which patches exist. No additional mitigation steps are indicated beyond applying the official patches.