CVE-2026-61143: oracle corporation oracle communications convergent charging controller Improper Access Control

Vulnerability summary

CVE-2026-61143 is a medium (CVSS 6.4) Improper Access Control vulnerability in oracle corporation oracle communications convergent charging controller. EPSS estimates a 0.31% chance of exploitation in the next 30 days, higher than 22.8% of scored vulnerabilities.

Timeline

1. 21-07-2026
   PublishedVulnerability first disclosed.
2. 23-07-2026
   Last modifiedVulnerability information updated.

Description

Vulnerability in the Oracle Communications Convergent Charging Controller product of Oracle Communications (component: Prov IF). Supported versions that are affected are 15.0.0.0.0 and 15.2.0.0.0. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Communications Convergent Charging Controller. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Communications Convergent Charging Controller. CVSS 3.1 Base Score 6.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H).

• CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
• CWE-304Missing Critical Step in AuthenticationThe product implements an authentication technique, but it skips a step that weakens the technique.
• CWE-601URL Redirection to Untrusted Site ('Open Redirect')The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
• CWE-640Weak Password Recovery Mechanism for Forgotten PasswordThe product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.