Oracle Communications UIM CVE-2026-91612

Exploitation requires the attacker to already have a valid low-privileged logon (PR:L) to the infrastructure where Oracle Communications UIM executes - this is explicitly a LOCAL vector (AV:L), so remote network exploitation is not possible. Affected versions are 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0 and 8.0.1 in the Security component. No user interaction is needed (UI:N) and attack complexity is low (AC:L), but the mandatory prerequisite of pre-existing authenticated local access to the host is the primary limiting factor; impact is confined to read-only disclosure of a subset of UIM data with no write or availability effect.

This is a low-severity issue (CVSS 3.1 base 3.3) and the real-world risk is correspondingly low. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) confirms exploitation requires LOCAL access - the attacker must already have a logon to the infrastructure where Oracle Communications Unified Inventory Management (UIM) runs - plus low-level privileges (PR:L). Impact is limited to unauthorized read of a SUBSET of accessible data (C:L only; no integrity or availability impact). No EPSS score, KEV listing, POC, or SSVC decision data was provided in the input; the absence of these is itself informative - there is no public exploit identified at time of analysis and no evidence of active exploitation. Signals are internally consistent: a low CVSS with a local vector and partial confidentiality impact does not indicate a priority flaw. NOTE A DISCREPANCY: the input Tag 'Authentication Bypass' conflicts with the description, which describes an already-authenticated low-privileged user gaining unauthorized read access - this is information disclosure, not an authentication bypass; the tag appears mislabeled and should not drive prioritization.

An attacker who already holds a low-privileged account and local logon access to the server hosting Oracle Communications UIM leverages the flaw to read a subset of data they should not be able to access. No public exploit code was identified in the provided intelligence, and because the vector is local with low complexity, the practical barrier is obtaining a foothold rather than exploit sophistication.