What is the CVSS score of CVE-2026-61095?

CVE-2026-61095 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle Communications UIM are affected by CVE-2026-61095?

A data access vulnerability in Oracle Communications Unified Inventory Management (versions 7.5.0-8.0.1) allows low-privilege users to read sensitive infrastructure inventory data; no public exploit…

How to fix or mitigate CVE-2026-61095?

Within 24 hours: Identify all systems running affected Oracle UIM versions (7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0, 8.0.1) and document data classifications stored in each instance. Within 7 days: restrict network access to UIM through firewall rules limiting to authorized personnel, enforce account access controls and least-privilege principles, and enable detailed audit logging of all data access. Within 30 days: monitor Oracle security advisories for patch release, plan upgrade to patched version when available, and conduct comprehensive review of UIM user accounts and permissions to prevent unauthorized access.

Oracle Communications UIM CVE-2026-61095

EUVD-2026-47306 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-r9px-vm43-66v8

Authentication Bypass Oracle Communications Unified Inventory Management

7.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

7.1 HIGH

Network HTTP-reachable Security component exploitable with low complexity by a low-privilege account (PR:L, not PR:N), yielding high confidentiality and low integrity impact with no availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:51 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 7.1

DescriptionCVE.org

Vulnerability in the Oracle Communications Unified Inventory Management product of Oracle Communications (component: Security). Supported versions that are affected are 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0 and 8.0.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Communications Unified Inventory Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Communications Unified Inventory Management accessible data as well as unauthorized update, insert or delete access to some of Oracle Communications Unified Inventory Management accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).

AnalysisAI

Unauthorized data access in Oracle Communications Unified Inventory Management (versions 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0, and 8.0.1) allows a low-privileged attacker with HTTP network access to compromise the Security component, gaining read access to all UIM-accessible data plus limited update, insert, or delete capability. Rated CVSS 3.1 7.1 (C:H/I:L) and flagged by Oracle as easily exploitable, though no public exploit has been identified and it is not listed in CISA KEV. The vendor 'Authentication Bypass' tag suggests the flaw undermines authorization controls despite requiring only low privileges to begin.

Technical ContextAI

Oracle Communications Unified Inventory Management (UIM) is a telecom-grade inventory and resource management platform (typically Java/WebLogic-based) used by carriers to model physical and logical network resources, services, and their lifecycle. The flaw resides in UIM's Security component and is exposed over HTTP, meaning the vulnerable surface is the web/application tier rather than a lower-level protocol. Oracle assigned no CWE (CWE: N/A), and the intelligence tag 'Authentication Bypass' points toward a broken access-control or authorization-enforcement weakness (CWE-287/CWE-863 class) where an authenticated low-privilege session can reach data and operations beyond its intended scope. The CVSS scope is Unchanged (S:U), so impact is confined to the UIM instance itself.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (Patch available per vendor advisory) documented at https://www.oracle.com/security-alerts/cpujul2026.html; consult that CPU matrix for the exact patch/bundle mapped to your running UIM version (7.5.0 through 8.0.1), as the input does not enumerate an exact fixed version number. Because exploitation requires network HTTP access with a low-privilege account, effective compensating controls until patching include restricting UIM's HTTP/application endpoints to trusted management networks or VPN and placing them behind a WAF or reverse proxy with access controls (trade-off: may complicate legitimate remote or integration access), tightening and auditing low-privilege UIM account provisioning and rotating credentials to shrink the pool of accounts that could abuse the flaw, and increasing monitoring of UIM data-access and modification logs for anomalous read/update/insert/delete activity. These are mitigations only and do not replace the CPU patch.