CVE-2026-83419

Awaiting Analysis Awaiting Analysis - Queue

Oracle Communications Cloud Native Core Security Edge Protection Proxy Information Disclosure and Modification

Publication date: 2026-09-15

Last updated on: 2026-09-22

Assigner: Oracle

Description

Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: SEPP). Supported versions that are affected are 26.1.200 and 25.2.201. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Cloud Native Core Security Edge Protection Proxy. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Communications Cloud Native Core Security Edge Protection Proxy accessible data as well as unauthorized read access to a subset of Oracle Communications Cloud Native Core Security Edge Protection Proxy accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-22

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-83419

EUVD

EUVD-2026-79720

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	communications_cloud_native_core_security_edge_protection_proxy	26.1.200
oracle	communications_cloud_native_core_security_edge_protection_proxy	25.2.201

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Communications Cloud Native Core Security Edge Protection Proxy (SEPP) versions 26.1.200 and 25.2.201. It allows a low-privileged attacker with network access via HTTP to read or modify some data in the SEPP component. The vulnerability has a CVSS base score of 5.4, indicating moderate risk with impacts on confidentiality and integrity.

Detection Guidance

This vulnerability affects Oracle Communications Cloud Native Core Security Edge Protection Proxy versions 26.1.200 and 25.2.201. Detection involves checking the installed version of the SEPP component. Use commands like 'kubectl get pods' (for Kubernetes environments) or inspect package versions if deployed on other platforms. Verify if the version matches affected releases.

Impact Analysis

An attacker could exploit this to read sensitive data or make unauthorized changes to SEPP data. This could lead to data breaches, unauthorized modifications, or disruptions in network security functions if the SEPP is part of a critical infrastructure.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, which may violate GDPR (data protection) or HIPAA (health data privacy) requirements. Organizations using affected SEPP versions may face compliance violations and potential penalties.

Mitigation Strategies

Apply the latest security patches from Oracle for affected versions 26.1.200 and 25.2.201. Isolate the SEPP component from untrusted networks and restrict HTTP access. Monitor for unusual data access or modification attempts.

Hi! I’m here to help you understand CVE-2026-83419. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70