Oracle Utilities NMS CVE-2026-101517

Exploitation requires the attacker to possess a low-privileged account with interactive logon access to the infrastructure/host where Oracle Utilities Network Management System executes (AV:L, PR:L) - it is NOT remotely reachable over the network and NOT unauthenticated. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once local authenticated access is held, exploitation is reliable against affected versions (2.4.0.1.0-2.4.0.1.33, 2.5.0.1.0-2.5.0.1.18, 2.5.0.2.0-2.5.0.2.11, 2.6.0.1.0-2.6.0.1.12, 2.6.0.2.0-2.6.0.2.9, 25.12.0.0.0-25.12.0.0.2). The primary limiting factor is the requirement for pre-existing authenticated local access; impact is confined to confidentiality (data disclosure), with no integrity or availability effect.

This is a moderate, not high-priority, issue. The CVSS 3.1 base score is 5.5 (Medium), driven entirely by a confidentiality impact (C:H/I:N/A:N) with a local attack vector (AV:L), low complexity (AC:L), low privileges required (PR:L), and no user interaction (UI:N). The vector confirms the attacker must already have authenticated logon access to the infrastructure where the product runs - this is not remotely exploitable and not an unauthenticated flaw, which significantly limits real-world reach. No EPSS score was provided in the input (exploitation probability unknown), the CVE is not listed in CISA KEV, and no public exploit code is referenced, so there is no public exploit identified at time of analysis. The SSVC framework cannot be fully applied as exploitation status is 'none observed', automatable is likely 'no' (requires prior authenticated local access), and technical impact is partial (data disclosure only). Signals are broadly consistent - a medium-severity, authenticated, local information-disclosure bug - with one conflict: the input Tag 'Authentication Bypass' contradicts the CVSS vector, which requires existing low privileges (PR:L) rather than bypassing authentication. The Oracle advisory label of 'unauthorized access to critical data' aligns with C:H but does not elevate this to critical-priority given the local, authenticated prerequisites.

An attacker who already holds a low-privileged account with logon access to the server or infrastructure hosting Oracle Utilities Network Management System abuses the System Wide component to read data they should not be authorized to see. Because the attack vector is local (AV:L) with low complexity and no user interaction, a malicious insider or an attacker who has gained a foothold via another vector can reliably extract sensitive outage-management and grid data. No public proof-of-concept exploit is referenced in the available data.