CVE-2026-47007
Summary
by MITRE • 07/21/2026
Vulnerability in the Oracle Communications Pricing Design Center product of Oracle Communications (component: On-premise Deployment). Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Pricing Design Center executes to compromise Oracle Communications Pricing Design Center. While the vulnerability is in Oracle Communications Pricing Design Center, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Communications Pricing Design Center accessible data as well as unauthorized update, insert or delete access to some of Oracle Communications Pricing Design Center accessible data. CVSS 3.1 Base Score 7.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/21/2026
The vulnerability under examination resides within Oracle Communications Pricing Design Center, specifically affecting on-premise deployment environments across versions 15.0.0.0.0 through 15.2.0.0.0. This represents a significant security weakness that operates at the system level rather than within application logic, making it particularly dangerous for organizations relying on this pricing infrastructure. The vulnerability's classification as easily exploitable indicates that an attacker with minimal privileges can leverage existing access to compromise the target system, suggesting a fundamental flaw in privilege separation or access control mechanisms. According to CVE standards and CVSS scoring methodology, this vulnerability demonstrates a base score of 7.3 which places it in the high severity category, reflecting the combination of confidentiality and integrity impacts that could be achieved.
The technical flaw manifests as an insufficient authorization check within the Oracle Communications Pricing Design Center execution environment, allowing attackers with low privilege access to escalate their privileges and gain unauthorized access to sensitive data. This type of vulnerability directly maps to CWE-284 (Improper Access Control) which describes weaknesses where systems fail to properly enforce access restrictions. The attack vector requires local access to the system where Oracle Communications Pricing Design Center operates, indicating that the vulnerability is not remotely exploitable but rather relies on an attacker already having some level of access to the host infrastructure. The CVSS vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N clearly demonstrates that local access is required, the attack is straightforward to execute, and a low privileged user can exploit this weakness.
The operational impact extends beyond the immediate Oracle Communications Pricing Design Center system, creating what is known as scope change in vulnerability assessment terminology. This means that successful exploitation could potentially affect additional products or systems within the same network environment, indicating that the vulnerability serves as a potential entry point for broader compromise. The confidentiality impact rated as high (C:H) suggests that attackers can access critical pricing data, customer information, and business-sensitive pricing configurations that are typically protected. The integrity impact rated as low (I:L) indicates that while modifications to data are possible, the primary concern remains unauthorized data access rather than malicious data corruption.
Organizations should implement immediate mitigations including strengthening local system access controls, implementing principle of least privilege for system accounts, and conducting comprehensive access reviews for all users with local system access. Network segmentation strategies should be considered to limit lateral movement if an attacker compromises a system. Regular security assessments and vulnerability scanning should be performed on all Oracle Communications Pricing Design Center installations to identify potential exploitation vectors. The ATT&CK framework categorizes this type of vulnerability under privilege escalation techniques where attackers leverage existing low privilege accounts to gain higher system access, making it essential for security teams to monitor for unusual local account activities and implement proper audit trails for all system access attempts. Additionally, patch management processes should be prioritized to ensure timely deployment of Oracle's security patches when they become available to address this specific vulnerability.