Oracle Communications UIM CVE-2026-101604

No special conditions beyond network reachability - remote unauthenticated exploitation (AV:N/AC:L/PR:N/UI:N) against Oracle Communications Unified Inventory Management versions 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0, and 8.0.1 via HTTP, targeting the Security component. The practical limiting factor is exposure: UIM is a back-office telecom OSS application normally deployed on internal/management networks behind operator perimeters, so exploitation requires the attacker to reach the HTTP interface, which is not typically internet-facing. Impact is confined to confidentiality (C:H); no integrity or availability effect and no privilege escalation to the host.

This is a serious confidentiality flaw whose signals are mostly consistent. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) and the description agree: an unauthenticated, network-based attacker over HTTP can read all data accessible to Oracle Communications Unified Inventory Management, with no integrity or availability impact. The HIGH severity is driven entirely by the confidentiality impact against a system that typically holds sensitive telecom inventory, subscriber, and network topology data. However, several real-risk signals are MISSING: no EPSS score, no CISA KEV listing, and no POC indicator were supplied, so exploitation probability cannot be quantified. Oracle's own advisories historically do not publish technical detail or exploit code, which tends to delay public exploitation. The 'Authentication Bypass' tag aligns with the PR:N (unauthenticated) vector but is not independently corroborated by the description, which speaks of unauthorized data access rather than a specific auth-bypass mechanism. Net assessment: a genuine high-priority patch item for the (relatively small) population of telecom operators running UIM, but there is no evidence of widespread or active exploitation - prioritize based on the sensitivity of inventory data exposed rather than on an imminent mass-exploitation threat.

An attacker with only network reachability to the UIM web interface sends crafted HTTP requests to the vulnerable Security component and, without any credentials, retrieves critical inventory data it should not be able to access. No public exploit code was identified at time of analysis, and the low attack complexity (AC:L) means no special timing or race conditions are required once network access is obtained.