What is the CVSS score of CVE-2026-46981?

CVE-2026-46981 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of Oracle Utilities Network Management System are affected by CVE-2026-46981?

Oracle Utilities Network Management System mobile component (versions 2.5.x, 2.6.x, 25.12.x) contains an unauthenticated authentication bypass that allows remote attackers to read and modify network…

How to fix or mitigate CVE-2026-46981?

Within 24 hours, inventory all Oracle Utilities NMS deployments to identify affected versions (2.5.x, 2.6.x, 25.12.x) and implement network-level access restrictions limiting HTTP access to the mobile component from untrusted networks. Within 7 days, apply the Oracle Critical Patch Update from July 2026 to all affected systems. Within 30 days, complete patch verification across all instances and conduct a comprehensive security assessment of adjacent systems to determine the extent of potential scope change impact.

Oracle Utilities Network Management System CVE-2026-46981

EUVD-2026-46470 HIGH

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-622f-77jv-2jv5

Authentication Bypass Oracle Oracle Utilities Network Management System Oracle Corporation

7.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:13 vuln.today

CVE Published

Jul 21, 2026 - 21:32 cve.org

HIGH 7.2

DescriptionCVE.org

Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: Mobile). Supported versions that are affected are 2.5.0.1.0-2.5.0.1.17, 2.5.0.2.0-2.5.0.2.11, 2.6.0.1.0-2.6.0.1.12, 2.6.0.2.0-2.6.0.2.8 and 25.12.0.0.0-25.12.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Utilities Network Management System. While the vulnerability is in Oracle Utilities Network Management System, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Utilities Network Management System accessible data as well as unauthorized read access to a subset of Oracle Utilities Network Management System accessible data. CVSS 3.1 Base Score 7.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).

AnalysisAI

Unauthenticated network compromise of Oracle Utilities Network Management System (Mobile component) allows remote attackers to gain partial read access and partial write (insert/update/delete) access to NMS-accessible data over HTTP, with a scope change that can significantly impact adjacent products. Oracle tags this as an Authentication Bypass and rates it CVSS 7.2; no public exploit was identified at time of analysis, and it is not listed in CISA KEV. Affected releases span the 2.5.x, 2.6.x, and 25.12.x branches, fixed in the Oracle Critical Patch Update of July 2026.