EUVD-2026-46469
GHSA-jpm9-x23f-7r3r
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-accessible HTTP interface, no complexity or interaction required; PR:L confirmed by need for valid low-privileged account; impact is confidentiality-only, low severity, unchanged scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: Mobile). Supported versions that are affected are 2.5.0.1.0-2.5.0.1.17, 2.5.0.2.0-2.5.0.2.11, 2.6.0.1.0-2.6.0.1.12, 2.6.0.2.0-2.6.0.2.8 and 25.12.0.0.0-25.12.0.0.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Utilities Network Management System. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Utilities Network Management System accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
AnalysisAI
Unauthorized data read in Oracle Utilities Network Management System's Mobile component allows low-privileged, network-adjacent attackers to access a subset of confidential NMS data via HTTP. Affected are five distinct version branches spanning 2.5.0.1.x through 25.12.0.0.x, as detailed in Oracle's July 2026 Critical Patch Update. Oracle classifies this as 'easily exploitable,' and the 'Authentication Bypass' tag suggests authorization control weaknesses beyond the low-privilege requirement implied by PR:L; no public exploit or CISA KEV listing exists at time of analysis.
Technical ContextAI
Oracle Utilities Network Management System is an enterprise-grade SCADA-adjacent platform used by electric, gas, and water utilities for real-time grid and network operations. The affected component is the Mobile subsystem (CPE: cpe:2.3:a:oracle_corporation:oracle_utilities_network_management_system:*:*:*:*:*:*:*:*), which exposes functionality over HTTP. The CWE is unspecified (reported as N/A), but the 'Authentication Bypass' tag alongside a PR:L CVSS vector points to a likely authorization bypass or broken access control weakness (CWE-285 or CWE-862 class), where a legitimately authenticated low-privileged user can read data beyond their authorized scope - rather than a complete pre-authentication bypass. The attack surface is the HTTP interface of the Mobile component, exploitable over the network without user interaction.
RemediationAI
Apply the patches released in Oracle's July 2026 Critical Patch Update (CPU), available at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle's CPU advisories include specific patch identifiers and upgrade paths for each affected version branch; the exact patched version numbers are not independently confirmed outside the Oracle advisory, so consult the CPU directly for the correct target version per your installed branch. If immediate patching is not possible, restrict network access to the NMS Mobile component's HTTP interface to only trusted internal network segments using firewall or network ACL rules - this does not eliminate the vulnerability but removes remote exploitability for external threat actors. Additionally, audit low-privileged user accounts with access to the Mobile component and apply the principle of least privilege to limit the data any single account can read, reducing the blast radius of unauthorized access.
Unauthenticated network compromise of Oracle Utilities Network Management System (Mobile component) allows remote attack
Unauthorized data access and manipulation in Oracle Utilities Network Management System exposes the Security component a
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today