CVE-2026-61226
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
A vulnerability in Oracle Communications Converged Application Server (RTP Proxy component) version 8.3. Difficult to exploit, requires logon to infrastructure and high privileges. Successful attack can lead to server takeover and impact other products (scope change). CVSS 7.5.
Risk Assessment
The risk is takeover of Oracle Communications Converged Application Server by a privileged attacker with local access, potentially compromising confidentiality, integrity, and availability in the communications environment.
Recommendation
Apply patches provided by Oracle in the Critical Patch Update (CPU). Restricting local access to the server can reduce risk.
Other vulnerabilities in Oracle Communications Converged Application Server
See all- CVE-2026-61223Critical
Vulnerability in Oracle Communications Converged Application Server allows an unauthenticated attacker via TCP/IP to take over the server. Exploitation is difficult but may affect other products.
- CVE-2026-61225High
Vulnerability in Oracle Communications Converged Application Server (Core component) versions 8.2 and 8.3. Difficult to exploit, allows an unauthenticated attacker with network access via TCP/IP to take over the server.
- CVE-2026-61224High
Vulnerability in Oracle Communications Converged Application Server version 8.3. Difficult to exploit, allows a high-privileged attacker with network access via TLS to take over the server and impact additional products.
Original NVD description (English source)
Vulnerability in the Oracle Communications Converged Application Server product of Oracle Communications (component: RTP Proxy). The supported version that is affected is 8.3. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Communications Converged Application Server executes to compromise Oracle Communications Converged Application Server. While the vulnerability is in Oracle Communications Converged Application Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Communications Converged Application Server. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).