Oracle Utilities Network Management System CVE-2026-83343

No special conditions - remote unauthenticated exploitation against default configurations of Oracle Utilities Network Management System is possible, per CVSS:3.1/AV:N/AC:L/PR:N/UI:N, requiring only network reachability to the application's HTTP interface and a crafted request to the System Wide component. There is no required user interaction, no required account, and no stated non-default feature toggle. Limiting factors: the target must expose its HTTP web tier to the attacker's network path (an instance firewalled to a trusted management VLAN is materially harder to reach), the flaw's write impact is only Low (integrity of some data, not all, and no availability impact), and exploitation of any specific instance depends on being on one of the affected version ranges (2.5.0.2.0-2.5.0.2.13, 2.6.0.1.0-2.6.0.12B, 2.6.0.2.0-2.6.0.2.10A, 25.12.0.0.0-25.12.0.0.3) - patched builds are unaffected.

The CVSS 3.1 vector is genuinely severe on paper: network vector, low complexity, no privileges, no user interaction, high confidentiality impact - an 8.2 that is automatable and requires no social engineering. The absence of an A (availability) metric and only a Low integrity impact temper the score, and importantly the report carries no EPSS probability, no CISA KEV entry and no confirmed public exploit code, so there is no evidence of exploitation in the wild; exploitation status is 'no public exploit identified at time of analysis'. Against that, the affected product is a niche utility-sector application, so mass scanning is less likely than for a mainstream web server, although unauthenticated single-request flaws of this shape are attractive to opportunistic scanners once details leak via CPU advisories. Missing data must be stated explicitly: no CWE, no EPSS, no patch-version confirmation beyond the Oracle CPU advisory link, and no independent PoC reporting - treat the practical urgency as high for exposed internet-facing deployments and elevated-but-manageable for segmented, internal-only ones. Under an SSVC-style read: exploitation = none observed, automatable = yes, technical impact = partial (confidentiality-dominant), which argues for 'attended' patching with priority on any instance reachable from untrusted networks.

An attacker with network reach to the NMS web interface sends a crafted HTTP request to a System Wide endpoint that fails to enforce authentication, gaining access to protected application data without any credentials. Because no user interaction or complexity is required, this can be scripted and repeated across hosts; successful requests yield high-value read access to utility network and customer/operational data plus limited ability to alter records. No public exploit code was identified in the provided data, so any such activity would currently reflect targeted or opportunistic probing rather than a known weaponized toolkit.