What is the CVSS score of CVE-2026-71142?

CVE-2026-71142 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle UIM are affected by CVE-2026-71142?

Oracle Communications Unified Inventory Management versions 7.5-8.0.1 contains an authentication bypass allowing unauthenticated remote attackers to access all inventory data via HTTP without…

How to fix or mitigate CVE-2026-71142?

Within 24 hours, identify all systems running Oracle Communications Unified Inventory Management versions 7.5.0-7.5.1, 7.6.0-7.8.0, or 8.0.1 and immediately restrict network access via firewall rules or take systems offline if operationally feasible. Within 7 days, deploy mandatory network segmentation (reverse proxy authentication, WAF, or VPN-only access) to prevent unauthenticated remote access and establish contact with Oracle Support to monitor for patch availability. Within 30 days, validate that compensating controls are fully deployed and monitored in all environments, develop a contingency replacement or upgrade plan, and conduct an audit of historical access logs for signs of exploitation.

Oracle UIM CVE-2026-71142

EUVD-2026-62084 HIGH

Improper Access Control (CWE-284)

2026-08-18 secalert_us@oracle.com

GHSA-h5gg-cwq5-vfrr

Authentication Bypass Oracle Communications Unified Inventory Management

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-accessible authentication bypass with no privileges or interaction required; only confidentiality is impacted with no integrity or availability effects described.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 18, 2026 - 22:20 vuln.today

CVE Published

Aug 18, 2026 - 21:18 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Oracle Communications Unified Inventory Management product of Oracle Communications (component: Security Component). Supported versions that are affected are 7.5.0-7.5.1, 7.6.0-7.8.0 and 8.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Inventory Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Communications Unified Inventory Management accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

AnalysisAI

Unauthorized data disclosure in Oracle Communications Unified Inventory Management (versions 7.5.0-7.5.1, 7.6.0-7.8.0, and 8.0.1) exposes critical inventory data to unauthenticated remote attackers over HTTP. The flaw resides in the Security Component and is tagged as an Authentication Bypass, meaning the platform's access controls can be circumvented without any credentials or user interaction, granting complete read access to all data the application can reach. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires only HTTP network access to an Oracle Communications Unified Inventory Management instance running one of the affected versions (7.5.0-7.5.1, 7.6.0-7.8.0, or 8.0.1). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 score of 7.5 (High) is well-calibrated to the threat: an unauthenticated attacker over the network with low complexity and no user interaction can exfiltrate all data the application can access. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Apply the patches provided in the Oracle Critical Security Patch Update for August 2026 by consulting https://www.oracle.com/security-alerts/cspuaug2026.html and the associated My Oracle Support (MOS) notes, as no specific fixed version number is stated in the available advisory data - the exact patched release must be confirmed through Oracle's advisory or support portal. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify all systems running Oracle Communications Unified Inventory Management versions 7.5.0-7.5.1, 7.6.0-7.8.0, or 8.0.1 and immediately restrict network access via firewall rules or take systems offline if operationally feasible. …

Threat intelligence, references, and detailed analysis are available after sign-in.