CVE-2026-83418

Received Received - Intake

Unauthorized Data Access in Oracle Communications Cloud Native Core Security Edge Protection Proxy

Publication date: 2026-09-15

Last updated on: 2026-09-18

Assigner: Oracle

Description

Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: SEPP). Supported versions that are affected are 26.1.200 and 25.2.201. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Security Edge Protection Proxy. While the vulnerability is in Oracle Communications Cloud Native Core Security Edge Protection Proxy, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Communications Cloud Native Core Security Edge Protection Proxy accessible data as well as unauthorized access to critical data or complete access to all Oracle Communications Cloud Native Core Security Edge Protection Proxy accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-18

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-83418

EUVD

EUVD-2026-79719

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	communications_cloud_native_core_security_edge_protection_proxy	26.1.200
oracle	communications_cloud_native_core_security_edge_protection_proxy	25.2.201

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Communications Cloud Native Core Security Edge Protection Proxy affecting versions 26.1.200 and 25.2.201. A low-privileged attacker with network access via HTTP can exploit it to compromise the system. Successful exploitation may lead to unauthorized data creation, deletion, or modification, as well as unauthorized access to critical data.

Detection Guidance

This vulnerability affects Oracle Communications Cloud Native Core Security Edge Protection Proxy versions 26.1.200 and 25.2.201. Detection requires checking installed versions of this product. Use commands like 'docker ps' or 'kubectl get pods' to identify running instances, then inspect version details via logs or configuration files. Monitor network traffic for HTTP requests targeting SEPP components.

Impact Analysis

The vulnerability allows attackers to access, modify, or delete critical data within the Oracle Communications Cloud Native Core Security Edge Protection Proxy. This could lead to data breaches, loss of sensitive information, or system compromise, potentially affecting operations relying on this product.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Organizations using the affected product may face legal penalties, reputational damage, or loss of certification due to data exposure or integrity issues.

Mitigation Strategies

Apply the latest security patches from Oracle for versions 26.1.200 and 25.2.201. Isolate the affected SEPP component from untrusted networks. Monitor network traffic for unusual HTTP requests targeting the SEPP service.

Hi! I’m here to help you understand CVE-2026-83418. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70