CVE-2026-83418

An improper-authorization vulnerability in Oracle Communications Cloud Native Core Security Edge Protection Proxy (SEPP) — the 5G network element that secures inter-operator roaming traffic on the N32 interface — allows a low-privileged attacker with network access via HTTP to fully compromise the proxy. Exploitation is rated difficult (attack complexity high), but a successful attack grants unauthorized creation, deletion, or modification of, and complete read access to, all SEPP-accessible data, and the scope change means other products beyond SEPP in the operator's environment can be significantly impacted as well. Affected releases are 26.1.200 and 25.2.201, so telecom operators running Oracle's cloud-native 5G core with roaming interconnect are the affected population. No public proof of concept is known and the flaw is not on CISA's KEV, so there is no indication of exploitation in the wild.

What to do: Apply Oracle's latest Critical Patch Update to move off affected releases 26.1.200 and 25.2.201 as soon as the fixed version is available. Restrict HTTP network access to the SEPP to trusted roaming partners and internal management segments, enforce mutual TLS and strong authentication on N32 and management interfaces, and review or revoke unnecessary low-privileged accounts. Audit SEPP logs for unexpected data creation, modification, or access and watch for lateral impact on adjacent 5G core components given the scope change.