Improper input validation in Communications Unified Assurance - CVE-2026-49844

Vulnerability identifier: #VU161962

CSH Severity: Medium

CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-49844

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the Core (Apache Log4j) component in Oracle Communications Unified Assurance. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.

Communications Unified Assurance
Db2 Developer Extension
Enterprise Manager Base Platform
openEuler
log4j
log4j-bom
log4j-help
log4j-jcl
log4j-jmx-gui
log4j-slf4j
log4j-taglib
log4j-web

Install updates from vendor's website.

Db2 Developer Extension - update to 1.2.0
log4j - update to 2.17.2-2
log4j-bom - update to 2.17.2-2
log4j-help - update to 2.17.2-2
log4j-jcl - update to 2.17.2-2
log4j-jmx-gui - update to 2.17.2-2
log4j-slf4j - update to 2.17.2-2
log4j-taglib - update to 2.17.2-2
log4j-web - update to 2.17.2-2

• https://www.oracle.com/security-alerts/cspusep2026.html

• Multiple vulnerabilities in Enterprise Manager Base Platform
• Multiple vulnerabilities in Communications Unified Assurance
• openEuler update for log4j
• Multiple vulnerabilities in IBM Db2 Developer Extension