CVE-2026-61143 in Communications Convergent Charging Controller
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Communications Convergent Charging Controller product of Oracle Communications (component: Prov IF). Supported versions that are affected are 15.0.0.0.0 and 15.2.0.0.0. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Communications Convergent Charging Controller. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Communications Convergent Charging Controller. CVSS 3.1 Base Score 6.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/22/2026
The Oracle Communications Convergent Charging Controller represents a critical component in telecommunications infrastructure responsible for billing and charging operations within communication networks. This system processes sensitive financial transactions and maintains comprehensive records of customer usage, making it a prime target for malicious actors seeking to compromise network operations and financial integrity. The vulnerability resides within the Prov IF component, which handles provisioning interfaces and communication protocols essential for system management and configuration.
This vulnerability classified as CVSS 3.1 score 6.4 represents a high-privilege attack vector requiring network access through HTTP protocol with difficult exploitation complexity. The attack requires human interaction from users other than the attacker, indicating that successful compromise typically involves social engineering or targeted user manipulation to execute malicious payloads. The vulnerability affects specifically versions 15.0.0.0.0 and 15.2.0.0.0 of the software, suggesting this issue emerged within a particular release cycle and may have been introduced through changes in HTTP handling mechanisms or authentication processes within the provisioning interface.
The technical flaw manifests as insufficient authorization controls or improper input validation within the Prov IF component, allowing malicious actors with network access to escalate privileges and potentially execute arbitrary code on the target system. The confidentiality, integrity, and availability impacts are all rated high, indicating that successful exploitation could result in complete system compromise where attackers gain full control over billing operations, customer data access, and network charging functionality. This vulnerability directly maps to CWE-285 (Improper Authorization) and potentially CWE-352 (Cross-Site Request Forgery) within the Common Weakness Enumeration framework.
The operational impact of this vulnerability extends beyond simple system compromise to encompass complete disruption of billing services and potential financial losses through unauthorized transaction processing. Attackers could manipulate charging records, create fraudulent bills, or disrupt service provisioning for customers, leading to significant revenue loss and regulatory compliance issues. The requirement for human interaction suggests that attackers might need to convince legitimate users to perform specific actions such as clicking malicious links or executing unauthorized provisioning commands, making this vulnerability particularly dangerous in environments where user trust is leveraged.
Mitigation strategies should focus on immediate patch deployment for affected versions, network segmentation to limit access to the Prov IF component, and implementation of strict access controls for HTTP endpoints. Organizations should enforce multi-factor authentication for administrative interfaces, monitor for suspicious provisioning activities, and conduct regular security assessments of their charging infrastructure. The ATT&CK framework categorizes this vulnerability under T1078 (Valid Accounts) and T1566 (Phishing) techniques, emphasizing the need for both technical controls and user awareness training to prevent exploitation through social engineering vectors that require human participation for successful compromise.