NCSC-2026-0200 [1.00] [M/H] Vulnerabilities fixed in Oracle Communications
Oracle has fixed vulnerabilities in Oracle Communications. The vulnerabilities are in two underlying products: SQLite and Log4j and have been previously fixed by the developers of these products. Oracle has incorporated the updates into its own software. In SQLite, a remote attacker can leak heap memory via specially crafted ZIP files due to an information leak in the zipfileInflate function of the zipfile extension. In Log4j, incorrect serialization of non-finite floating-point values such as NaN or infinity in the JsonTemplateLayout leads to invalid JSON output, which can disrupt downstream log processing systems when applications log MapMessages controlled by the attacker, causing a denial of service in log analysis workflows.
CSIRTS triage
- What
- Vulnerabilities in SQLite and Log4j can lead to information leaks and denial of service.
- Who is affected
- Deployments of Oracle Communications that utilize SQLite and Log4j.
- Urgency
- Remediation is important to prevent information leaks and disruptions in log processing.
- Action
- Incorporate the latest updates for SQLite and Log4j.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch Oracle Communications
Get an email when a new Oracle Communications advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://advisories.ncsc.nl/advisory?id=NCSC-2026-0200
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2025-708730.30% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 22% of all scored CVEs.
- Low exploitation riskCVE-2026-344810.56% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 42% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2025-70873 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-34481 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
More from NCSC-NL Advisories
- unknownNCSC-2026-0223 [1.00] [M/H] Vulnerabilities fixed in BeyondTrust Remote Support and Privileged Remote Access2026-07-10
- unknownNCSC-2026-0222 [1.00] [M/H] Vulnerabilities fixed in GitLab Enterprise Edition and Community Edition2026-07-10
- unknownNCSC-2026-0221 [1.00] [M/H] Vulnerabilities fixed in UniFi products from Ubiquiti Networks2026-07-07
- unknownNCSC-2026-0220 [1.00] [M/H] Vulnerabilities fixed in Rancher by Rancher Labs2026-07-03
- unknownNCSC-2026-0219 [1.00] [M/H] Vulnerabilities fixed in GitHub Enterprise Server2026-07-03