SB20261108144 - Multiple vulnerabilities in Communications Unified Assurance

Description

This security bulletin contains information about 24 vulnerabilities.

1) Input validation error (CVE-ID: CVE-2026-57220)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper input validation in rabbit_stream_core when processing oversized stream frames during authentication before Tune negotiation. A remote attacker can send oversized partial frames to cause a denial of service.

Only deployments with the first-party rabbitmq_stream listener enabled and reachable on port 5552 are vulnerable.

2) Path traversal (CVE-ID: CVE-2026-44024)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to path traversal in the `${tag}` placeholder handling in file path configuration when processing log tags from untrusted sources. A remote attacker can inject path traversal sequences into a crafted tag to execute arbitrary code.

Exploitation requires the `${tag}` placeholder to be used in file-related configuration such as the `path` parameter, and certain formatting options can enable arbitrary file write or overwrite of existing files.

3) Out-of-bounds write (CVE-ID: CVE-2026-17544)

CWE-ID: CWE-787 - Out-of-bounds write

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input within the bc_str2num() function. A remote attacker can pass specially crafted input to the application that is using the affected function, trigger an out-of-bounds write and crash the application or potentially execute arbitrary code.

4) Improper validation of certificate with host mismatch (CVE-ID: CVE-2026-71290)

CWE-ID: CWE-297 - Improper Validation of Certificate with Host Mismatch

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to impersonate the server.

The vulnerability exists due to improper certificate validation in the async transport of HttpClient when establishing TLS connections with HostnameVerificationPolicy#BUILTIN. A remote attacker can intercept and modify traffic and present a valid certificate for a different domain to impersonate the server.

The classic version of HttpClient is not affected.

5) Improper input validation (CVE-ID: CVE-2026-73194)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read data or crash the application.

The vulnerability exists due to improper input validation within the Core (DBI) component in Oracle Communications Unified Assurance. A remote non-authenticated attacker can exploit this vulnerability to read data or crash the application.

6) Insertion of Sensitive Information Into Sent Data (CVE-ID: CVE-2026-67355)

CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows an unauthenticated remote attacker to obtain sensitive host-only cookies intended for a parent host.

The vulnerability exists due to Guzzle's CookieJar treating cookies with absent or empty Domain attributes as domain-scoped rather than host-only. An unauthenticated remote attacker controlling or observing a child host can receive these cookies when cookie support is enabled and the application reuses the parent's built-in jar for a later child request satisfying the cookie's other restrictions.

7) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-64849) Exploited

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information from internal services and perform limited server-side requests to internal endpoints.

The vulnerability exists due to server-side request forgery (SSRF) in the MLflow webhook delivery and test_webhook endpoint when following HTTP redirects or re-resolving hostnames after validating the original webhook URL. A remote attacker can create a webhook pointing to an attacker-controlled HTTPS endpoint and trigger the unauthenticated test request to disclose sensitive information from internal services and perform limited server-side requests to internal endpoints.

On default servers, the webhook API is exposed without authentication, the first hop must use HTTPS, and the synchronous /api/2.0/mlflow/webhooks/{id}/test endpoint reflects the upstream response body to the caller. DNS rebinding can also bypass the validation because the validated IP is not pinned to the connection.

8) Incorrect authorization (CVE-ID: CVE-2026-54518)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass write-side authorization restrictions and modify view-restricted creator parameters.

The vulnerability exists due to improper authorization in UnwrappedPropertyHandler.processUnwrappedCreatorProperties() when processing untrusted JSON input for unwrapped creator parameters. A remote attacker can supply crafted JSON data to bypass write-side authorization restrictions and modify view-restricted creator parameters.

This issue occurs when applications use @JsonView as a write-side authorization boundary together with constructor parameters annotated with both @JsonView and @JsonUnwrapped.

9) Link following (CVE-ID: CVE-2026-39822)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to access files outside the intended root directory.

The vulnerability exists due to improper link resolution in os.Root file-opening functions when processing a path whose final component is a symbolic link and the path ends with a trailing slash. A local user can supply a crafted path to access files outside the intended root directory.

This issue affects Unix systems.

10) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-66299)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper resource management in the WebSocket chat example when buffering undelivered messages for a maliciously slow client connection. A remote attacker can maintain a slow client connection to cause a denial of service.

Only deployments exposing the example web application are vulnerable.

11) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-55952)

CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper validation of specified quantity in input in the TLS-1.3 session ticket handler when processing a malformed ClientHello with mismatched PSK identity and binder list lengths. A remote attacker can send a specially crafted ClientHello message to cause a denial of service.

Only TLS-1.3 servers with session tickets enabled are vulnerable. TLS-1.2 connections are not affected.

12) Uncontrolled Memory Allocation (CVE-ID: CVE-2026-50734)

CWE-ID: CWE-789 - Uncontrolled Memory Allocation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to memory allocation with excessive size value in OpenWire wire format negotiation when processing a WireFormatInfo frame during pre-authentication negotiation. A remote attacker can send a crafted WireFormatInfo frame with a malicious large size value to cause a denial of service.

The issue can trigger out-of-memory conditions and crash the broker.

13) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-12590)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in the request body size enforcement logic when handling requests with an invalid limit option value. A remote attacker can send an oversized request body to cause a denial of service.

This issue affects applications that use a programmatically computed or user-configurable limit value without validating it first.

14) Insufficient verification of data authenticity (CVE-ID: CVE-2026-49284)

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to bypass authentication and authorization checks.

The vulnerability exists due to insufficient verification of data authenticity in the SAML SP ACS path when processing a valid response from an unexpected trusted IdP with an unsigned Response/InResponseTo and no SubjectConfirmationData/InResponseTo in the signed assertion. A remote user can obtain a signed assertion from a lower-trust trusted IdP and submit it to satisfy SP state created for a different expected IdP to bypass authentication and authorization checks.

The issue is relevant in multi-IdP deployments where authorization decisions depend on the selected or expected IdP.

15) Improper input validation (CVE-ID: CVE-2026-41989)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.9 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local non-authenticated attacker to damange or delete data.

The vulnerability exists due to improper input validation within the Alarms, KPI, and Measurements (libgcrypt) component in Oracle Communications Cloud Native Core Policy. A local non-authenticated attacker can exploit this vulnerability to damange or delete data.

16) Information disclosure (CVE-ID: CVE-2026-59943)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper access control in embedded SVG image handling when rendering documents containing crafted SVG content. A remote attacker can embed references to filesystem paths in an SVG image to disclose sensitive information.

The issue can reveal the existence of files and directories on the underlying filesystem.

17) Improper input validation (CVE-ID: CVE-2026-19880)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Core (logback) component in Oracle Communications Unified Assurance. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

18) Improper input validation (CVE-ID: CVE-2026-61109)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote authenticated user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the Server: JSON component in MySQL Cluster. A remote authenticated user can exploit this vulnerability to perform a denial of service (DoS) attack.

19) Improper input validation (CVE-ID: CVE-2026-58520)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Core (MediaWiki) component in Oracle Communications Unified Assurance. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.

20) Improper input validation (CVE-ID: CVE-2026-13006)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to read and manipulate data.

The vulnerability exists due to improper input validation within the Core (logback) component in Oracle Communications Unified Assurance. A local privileged user can exploit this vulnerability to read and manipulate data.

21) Improper input validation (CVE-ID: CVE-2026-49844)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the Core (Apache Log4j) component in Oracle Communications Unified Assurance. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.

22) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2026-48998)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The disclosed vulnerability allows a remote attacker to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input in Host header. A remote attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.

Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.

23) Improper input validation (CVE-ID: CVE-2026-63308)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the Core (Helm) component in Oracle Communications Unified Assurance. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

24) Improper input validation (CVE-ID: CVE-2026-13758)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the Core (CryptX) component in Oracle Communications Unified Assurance. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

Remediation

Install update from vendor's website.

References

• https://www.oracle.com/security-alerts/cspusep2026.html