SB2026111091 - Multiple vulnerabilities in Oracle Communications Cloud Native Core Policy

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026111091

SB2026111091 - Multiple vulnerabilities in Oracle Communications Cloud Native Core Policy

Published: November 10, 2026

Security Bulletin ID SB2026111091
CSH Severity
High
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 33% Medium 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 vulnerabilities.


1) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2024-6763)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N]


The disclosed vulnerability allows a remote attacker to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input in HttpURI. A remote attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.

Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.


2) Improper access control (CVE-ID: CVE-2026-55956)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass security constraints.

The vulnerability exists due to improper access control in the default servlet when processing requests subject to configured security constraints with method or method omission settings. A remote attacker can send a crafted request using an ignored method to bypass security constraints.


3) Improper input validation (CVE-ID: CVE-2026-28369)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

The vulnerability exists due to improper input validation within the Alarms, KPI, and Measurements (Undertow) component in Oracle Communications Cloud Native Core Policy. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.


Remediation

Install update from vendor's website.

References