CVE-2026-83417

Awaiting Analysis Awaiting Analysis - Queue

Unauthenticated Access in Oracle Communications Cloud Native Core Security Edge Protection Proxy

Publication date: 2026-09-15

Last updated on: 2026-09-22

Assigner: Oracle

Description

Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: SEPP). Supported versions that are affected are 26.1.200 and 25.2.201. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Communications Cloud Native Core Security Edge Protection Proxy executes to compromise Oracle Communications Cloud Native Core Security Edge Protection Proxy. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Communications Cloud Native Core Security Edge Protection Proxy accessible data as well as unauthorized update, insert or delete access to some of Oracle Communications Cloud Native Core Security Edge Protection Proxy accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-22

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-83417

EUVD

EUVD-2026-79718

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	communications_cloud_native_core_security_edge_protection_proxy	26.1.200
oracle	communications_cloud_native_core_security_edge_protection_proxy	25.2.201

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability affects Oracle Communications Cloud Native Core Security Edge Protection Proxy versions 26.1.200 and 25.2.201. It allows an unauthenticated attacker with physical access to the network segment where the proxy runs to exploit it. The flaw enables unauthorized access to sensitive data and potential modifications to data within the proxy.

Detection Guidance

This vulnerability requires detection of Oracle Communications Cloud Native Core Security Edge Protection Proxy instances running vulnerable versions (26.1.200 or 25.2.201). Check for the presence of the affected component using system inventory tools or network scans. Verify software versions and patch levels to identify unpatched systems.

Impact Analysis

If you use the affected Oracle Communications Cloud Native Core Security Edge Protection Proxy versions, an attacker could gain access to critical data or alter data without authentication. This could lead to data breaches, unauthorized changes, or loss of data integrity.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations using the affected software may face legal penalties or reputational damage due to non-compliance.

Mitigation Strategies

Apply the latest security patches from Oracle for affected versions 26.1.200 and 25.2.201. Isolate the SEPP component on a restricted network segment to limit physical access. Monitor network traffic for unauthorized access attempts to the SEPP interface.

Hi! I’m here to help you understand CVE-2026-83417. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70