CVE-2026-83417: Oracle Cloud Native Core SEPP Auth Bypass

CVE-2026-83417 Overview

CVE-2026-83417 is a high-severity vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy (SEPP). The flaw affects supported versions 26.1.200 and 25.2.201. An unauthenticated attacker with access to the physical communication segment attached to the SEPP hardware can compromise the product. Successful exploitation grants unauthorized read access to all SEPP-accessible data and unauthorized update, insert, or delete access to a subset of that data. Oracle published the advisory under Security Alert CSPUSEP2026.

Critical Impact
An adjacent-network attacker without credentials can read all data accessible to Oracle Communications SEPP and modify a portion of that data, undermining 5G interconnect security controls.

Affected Products

Oracle Communications Cloud Native Core Security Edge Protection Proxy version 26.1.200
Oracle Communications Cloud Native Core Security Edge Protection Proxy version 25.2.201
SEPP component within Oracle Communications Cloud Native Core

Discovery Timeline

2026-09-15 - CVE-2026-83417 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-83417

Vulnerability Analysis

The Oracle Communications Cloud Native Core Security Edge Protection Proxy sits at the edge of 5G roaming interconnects. It mediates signaling traffic between mobile network operators over the N32 interface. A flaw in the SEPP component allows an unauthenticated attacker on the adjacent network to compromise the service.

Exploitation requires no user interaction and low attack complexity. The impact is scoped to high confidentiality loss and low integrity loss, with no direct availability impact. Because SEPP handles operator-to-operator signaling, exposure of accessible data can leak subscriber routing metadata and interconnect security material.

Oracle documented the issue in Security Alert CSPUSEP2026 outside of the regular Critical Patch Update cycle, indicating the vendor prioritized rapid disclosure. See the Oracle Security Alert CSPUSEP2026 for authoritative product guidance.

Root Cause

Oracle has not published the specific weakness class (no CWE is assigned in NVD). The advisory indicates the defect resides in the SEPP component and is reachable without authentication from the adjacent physical network segment. No CWE identifier is currently associated with the entry.

Attack Vector

The attacker must have access to the physical communication segment attached to the hardware running SEPP. This aligns with the CVSS Adjacent Network vector. From that position, the attacker sends crafted traffic to the SEPP service without credentials or user interaction. Successful requests return sensitive SEPP data and allow modification of a subset of records.

No public proof-of-concept, ExploitDB entry, or CISA KEV listing exists for CVE-2026-83417 at the time of writing.

Detection Methods for CVE-2026-83417

Indicators of Compromise

Unexpected read operations against SEPP configuration or signaling data from hosts on the same layer-2 segment
Unauthorized modifications to SEPP routing tables, security counterparts, or N32 handshake state
Signaling anomalies on the N32 interface that do not correlate with legitimate roaming partner activity

Detection Strategies

Enable verbose audit logging on Oracle Communications SEPP and forward events to a centralized analytics platform for correlation
Baseline the set of hosts permitted on the SEPP management and signaling VLANs, then alert on any new MAC or IP address appearing on those segments
Compare SEPP configuration snapshots on a scheduled basis to identify unauthorized inserts, updates, or deletions

Monitoring Recommendations

Monitor SEPP pod and container telemetry in the Cloud Native Core environment for unexpected API calls or configuration reloads
Track authentication and access logs from adjacent management systems that share the SEPP broadcast domain
Alert on the appearance of unmanaged devices on the physical segment attached to SEPP hardware

How to Mitigate CVE-2026-83417

Immediate Actions Required

Apply the fixes referenced in Oracle Security Alert CSPUSEP2026 to all SEPP deployments running 26.1.200 or 25.2.201
Inventory every SEPP instance and confirm the running version before and after patching
Restrict physical and logical access to the network segments hosting SEPP hardware to authorized operations staff only

Patch Information

Oracle published Security Alert CSPUSEP2026 addressing CVE-2026-83417. Refer to the Oracle Security Alert CSPUSEP2026 for patch download instructions and version-specific remediation guidance. Oracle recommends applying security alert fixes without delay.

Workarounds

Enforce strict network segmentation so that only authorized N32 peers and management stations share a broadcast domain with SEPP
Deploy port-security, 802.1X, or equivalent controls on switches serving SEPP hardware to block rogue devices
Terminate operator-to-operator traffic through an IPsec or TLS overlay so that the physical segment does not carry cleartext SEPP protocol data

bash

# Configuration example
# Verify running SEPP version prior to applying the CSPUSEP2026 fix
kubectl -n sepp get pods -o jsonpath='{.items[*].spec.containers[*].image}'

# Restrict the SEPP signaling VLAN to known peer MAC addresses (Cisco IOS example)
interface range GigabitEthernet1/0/1 - 4
 switchport mode access
 switchport access vlan 200
 switchport port-security
 switchport port-security maximum 1
 switchport port-security violation restrict
 switchport port-security mac-address sticky