Improper input validation in Oracle Communications Cloud Native Core Policy - CVE-2026-41989

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU159946

Improper input validation in Oracle Communications Cloud Native Core Policy - CVE-2026-41989

Published: November 7, 2026


Vulnerability identifier: #VU159946
CSH Severity: Low
CVSS v4: 5.9 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-41989
CWE-ID: CWE-20
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local non-authenticated attacker to damange or delete data.

The vulnerability exists due to improper input validation within the Alarms, KPI, and Measurements (libgcrypt) component in Oracle Communications Cloud Native Core Policy. A local non-authenticated attacker can exploit this vulnerability to damange or delete data.


Affected software

Oracle Communications Cloud Native Core Policy
Oracle Communications Cloud Native Core Console
Debian Linux
Anolis OS
openEuler
Fedora
Oracle Communications Cloud Native Core Binding Support Function
libgcrypt-doc
libgcrypt-devel
libgcrypt
libgcrypt-debuginfo
libgcrypt-help
libgcrypt-debugsource
libgcrypt20 (Debian package)

How to mitigate CVE-2026-41989

Install updates from vendor's website.

libgcrypt-doc - addressed in versions 1.8.5-8.0.1, 1.10.2-3
libgcrypt-devel - addressed in versions 1.8.5-8.0.1, 1.10.2-3
libgcrypt - addressed in versions 1.8.5-8.0.1, 1.10.2-3
libgcrypt-debuginfo - addressed in versions 1.10.2-3, 1.10.2-4
libgcrypt-help - addressed in versions 1.10.2-3, 1.10.2-4
libgcrypt-devel - addressed in versions 1.10.2-3, 1.10.2-4
libgcrypt-debugsource - addressed in versions 1.10.2-3, 1.10.2-4
libgcrypt - addressed in versions 1.10.2-3, 1.10.2-4
libgcrypt - addressed in versions 1.11.1-4.fc43, 1.12.2-1.fc44
libgcrypt20 (Debian package) - addressed in versions 1.10.1-3+deb12u1, 1.11.0-7+deb13u1

External References

Related Security Bulletins