SB20261110108 - Multiple vulnerabilities in Communications Unified Assurance
Published: November 10, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 25 vulnerabilities.
1) Improper access control (CVE-ID: CVE-2026-68525)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to bypass method-specific access controls.
The vulnerability exists due to improper access control in the FORM authentication process when handling a redirect after authentication. A remote user can complete FORM authentication and use the redirect flow to bypass method-specific access controls.
The issue affects constraints that restrict access to a resource for POST requests but not GET requests.
2) Improper input validation (CVE-ID: CVE-2026-64193)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
The vulnerability exists due to improper input validation within the Core (Net::DNS) component in Oracle Communications Unified Assurance. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.
3) Improper input validation (CVE-ID: CVE-2026-86219)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
The vulnerability exists due to improper input validation within the Core (Authen::SASL) component in Oracle Communications Unified Assurance. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.
4) Improper input validation (CVE-ID: CVE-2026-78030)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
The vulnerability exists due to improper input validation within the Core (DBI) component in Oracle Communications Unified Assurance. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.
5) Improper input validation (CVE-ID: CVE-2026-54906)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
The vulnerability exists due to improper input validation within the Core (Ruby) component in Oracle Communications Unified Assurance. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.
6) Out-of-bounds read (CVE-ID: CVE-2026-39892)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to out-of-bounds read in Python buffer-accepting APIs when processing a non-contiguous buffer. A local user can pass a specially crafted non-contiguous buffer to cause a denial of service.
The issue can read past the end of the buffer on Python versions later than 3.11.
7) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-75596)
CWE-ID: CWE-407 - Inefficient Algorithmic Complexity
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to inefficient algorithmic complexity in the default SNI parsing path when processing fragmented TLS ClientHello records before handshake completion. A remote attacker can send many tiny handshake fragments that advertise a large ClientHello length to cause a denial of service.
The issue can degrade or stall TLS connection handling for other clients on the affected event loop.
8) Improper input validation (CVE-ID: CVE-2026-84939)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
The vulnerability exists due to improper input validation within the Core (Apache FreeMarker) component in Oracle Communications Unified Assurance. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.
9) Uncontrolled Recursion (CVE-ID: CVE-2026-32327)
CWE-ID: CWE-674 - Uncontrolled Recursion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled recursion in apr_xml_quote_elem() when parsing XML from untrusted sources. A remote attacker can supply crafted XML input to cause a denial of service.
The issue affects library consumers that parse XML from untrusted sources and use the vulnerable function.
10) Improper Authentication (CVE-ID: CVE-2026-56130)
CWE-ID: CWE-287 - Improper Authentication
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to reuse a stolen authentication cookie indefinitely.
The vulnerability exists due to improper authentication in remember-me cookie handling when processing remember-me cookies on the server. A remote attacker can intercept a valid cookie and replay it after its expiration time to reuse a stolen authentication cookie indefinitely.
Only instances with RememberMe functionality enabled are vulnerable.
11) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-58389)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in the Rust binary protocol non-strict path when parsing crafted string fields. A remote attacker can send specially crafted input to cause a denial of service.
12) Improper Handling of Alternate Encoding (CVE-ID: CVE-2026-10050)
CWE-ID: CWE-173 - Improper Handling of Alternate Encoding
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass authentication.
The vulnerability exists due to improper handling of alternate encoding in DigestAuthentication.apply() when computing Digest authentication response hashes using ISO-8859-1 encoding. A remote attacker can use a password variant in which non-Latin-1 characters are replaced with '?' characters to bypass authentication.
Successful exploitation requires knowledge of the target username and a password containing characters outside the U+00FF range.
13) Improper input validation (CVE-ID: CVE-2026-13221)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote non-authenticated attacker to damange or delete data.
The vulnerability exists due to improper input validation within the Core (Perl) component in Oracle Communications Unified Assurance. A remote non-authenticated attacker can exploit this vulnerability to damange or delete data.
14) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-22702)
CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a race condition between directory existence checks and creation to redirect virtualenv's app_data and lock file operations to attacker-controlled locations. A local user can gain access to sensitive information, poison cache or perform a denial of service attack.
15) Improper input validation (CVE-ID: CVE-2026-61674)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
The vulnerability exists due to improper input validation within the Core (fluentbit) component in Oracle Communications Unified Assurance. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.
16) Use-after-free (CVE-ID: CVE-2026-63639)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error in stream deserialization. A remote user can use a specially crafted RESTORE command and execute arbitrary code on the target system.
17) Improper Access Control (CVE-ID: CVE-2026-21716)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to modify file permissions and ownership.
The vulnerability exists due to improper access control in FileHandle.chmod() and FileHandle.chown() methods in the promises API when modifying file metadata. A local user can run code under --permission with restricted --allow-fs-write to use promise-based FileHandle methods and change permissions or ownership of already-open file descriptors, bypassing intended write restrictions.
This issue affects only environments using the Permission Model with --allow-fs-write intentionally restricted.
Note, the vulnerability exists due to incomplete fix for #VU93881 (CVE-2024-36137).
18) Deserialization of Untrusted Data (CVE-ID: CVE-2026-41855)
CWE-ID: CWE-502 - Deserialization of Untrusted Data
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform unauthorized actions.
The vulnerability exists due to unsafe deserialization in org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.springframework.jms.support.converter.JacksonJsonMessageConverter when processing messages in an untrusted JMS environment. A remote attacker can send a crafted message to perform unauthorized actions.
Exploitation can lead to arbitrary class instantiation through gadget class deserialization.
19) Information Exposure Through an Error Message (CVE-ID: CVE-2026-69247)
CWE-ID: CWE-209 - Information Exposure Through an Error Message
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to recover plaintext from PKCS#7 EnvelopedData messages.
The vulnerability exists due to generation of error message containing sensitive information and observable timing discrepancy in pkcs7_decrypt_der, pkcs7_decrypt_pem, and pkcs7_decrypt_smime when decrypting attacker-supplied EnvelopedData. A remote attacker can send crafted EnvelopedData messages and observe distinguishable errors and timing differences to recover plaintext from PKCS#7 EnvelopedData messages.
Exploitation requires a service that automatically decrypts untrusted EnvelopedData for the victim certificate and returns adaptive responses at high volume.
20) Improper input validation (CVE-ID: CVE-2026-60075)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation within the Core (Date::Manip) component in Oracle Communications Unified Assurance. A remote non-authenticated attacker can exploit this vulnerability to perform a denial of service (DoS) attack.
21) Heap-based buffer overflow (CVE-ID: CVE-2026-55971)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service or execute arbitrary code.
The vulnerability exists due to heap-based buffer overflow in THeaderTransport::untransform() when processing ZLIB-compressed data. A remote attacker can send specially crafted compressed input to cause a denial of service or execute arbitrary code.
22) Improper input validation (CVE-ID: CVE-2021-42576)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.4 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote privileged user to execute arbitrary code.
The vulnerability exists due to improper input validation within the Core (bluemonday) component in Oracle Communications Unified Assurance. A remote privileged user can exploit this vulnerability to execute arbitrary code.
23) Code Injection (CVE-ID: CVE-2026-4800)
CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to improper control of code generation in _.template when processing untrusted options.imports key names. A remote attacker can supply crafted imports key names to execute arbitrary code.
Code execution occurs at template compilation time. If Object.prototype has been polluted by another vector, inherited polluted keys can also be copied into the imports object and passed to Function().
24) Authentication Bypass by Capture-replay (CVE-ID: CVE-2026-7168)
CWE-ID: CWE-294 - Authentication Bypass by Capture-replay
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to authentication bypass by capture-replay. A remote attacker can leak and reuse Digest proxy authentication state across proxies to impersonate the client.
25) Insecure Temporary File (CVE-ID: CVE-2026-41001)
CWE-ID: CWE-377 - Insecure Temporary File
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to tamper with message queue data, inject malicious messages, or potentially execute code.
The vulnerability exists due to insecure temporary file usage in ArtemisEmbeddedConfigurationFactory when initializing the embedded Artemis message broker without an explicit data directory path. A local user can pre-create the predictable directory or place a symlink before the application starts to tamper with message queue data, inject malicious messages, or potentially execute code.
Exploitation requires the application to use the embedded Artemis message broker with no explicit data directory configured.
Remediation
Install update from vendor's website.