EUVD-2026-106805
GHSA-29rp-cv23-c4r7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local logon
-
ExploitAccess UIM Security component
-
ImpactRead unauthorized subset of data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an existing low-privileged local logon (CVSS AV:L, PR:L) to the infrastructure where Oracle Communications Unified Inventory Management executes - the attacker must already be authenticated on that host. No user interaction is required (UI:N) and attack complexity is low (AC:L), but the local-access and prior-authentication requirements are the primary limiting factors, confining realistic exploitation to insiders or attackers who have already established a foothold. Impact is bounded to read access over a subset of UIM-accessible data (C:L; no integrity or availability impact). Affected versions are 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0, and 8.0.1. |
| Impact | This is a genuinely low-priority issue. The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) yields a base score of 3.3 (Low), and every signal is consistent: the attack vector is local, requiring the attacker to already have a logon to the infrastructure where Oracle Communications Unified Inventory Management (UIM) runs, privileges required are low, and the only impact is partial confidentiality (unauthorized read access to a subset of data) with no integrity or availability impact. No EPSS score was provided, there is no CISA KEV listing, and no public exploit code was referenced, so there is no evidence of active or likely exploitation. The one point of friction is the 'Authentication Bypass' tag, which conflicts with the description and vector: the flaw requires an authenticated local foothold (PR:L) and results in information disclosure, not a bypass of authentication - treat the tag as suspect rather than authoritative. Overall this is a low-CVSS, low-real-risk information-disclosure bug relevant mainly to defense-in-depth and insider/lateral-movement scenarios, not an urgent patch-now priority. |
| Exploit ScenarioDerived | An attacker who has already obtained a low-privileged local account on the server hosting Oracle Communications UIM (for example, a legitimate low-tier operator or an attacker who gained a foothold via another vector) leverages the flaw to read a subset of UIM-accessible data they should not be able to see. No user interaction and no elevated privileges are needed, but local logon is a prerequisite, and no public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
Oracle Communications Unified Inventory Management (UIM) versions 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0, and 8.0.1 expose a low-severity confidentiality weakness that lets an attacker who already holds a low-privileged logon on the UIM host read a subset of data the application would otherwise restrict. Per the independent assessment this is a genuinely low-priority issue: the local-access prerequisite (CVSS AV:L/PR:L) and the read-only, partial confidentiality impact (C:L, no integrity or availability effect) confine realistic exploitation to insiders or attackers who have already established a foothold on the infrastructure. There is no evidence of active exploitation (no CISA KEV listing), no public exploit code identified at time of analysis, and the reported tags reference authentication bypass, though the assessed vector and Oracle's scoring describe a local, authenticated information-read condition rather than a remotely reachable bypass.
RemediationAI
Apply the fix published in Oracle's October 2026 Critical Patch Update advisory (https://www.oracle.com/security-alerts/cpuoct2026.html), which is the vendor-released remediation path; the advisory lists the minimum patched versions for each affected 7.5.x, 7.6.0, 7.7.0, 7.8.0, and 8.0.1 line, and exact cloud/service-specific update versions should be taken from that document rather than assumed. Where patching must be staged, the most effective compensating control is to shrink the population that can satisfy the AV:L/PR:L prerequisite: audit and remove unnecessary local OS and application accounts on UIM hosts, restrict interactive shell and database access on those servers to a small administrative group, and enforce per-role data scoping in UIM so low-privileged roles cannot reach the exposed data subset - the trade-off is reduced operational convenience and possible disruption to shared service accounts used by integrations. Network segmentation that limits who can reach UIM hosts and their management interfaces adds defense against a foothold being leveraged, at the cost of additional access-management overhead. Because exploitation requires prior local authenticated access and the impact is limited to partial read, these controls are proportionate; monitor for anomalous low-privileged data reads until the CPU patch is applied.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is Oracle Communications Unified Inventory Management, a Java-based inventory and service-resource management platform used by telecom operators to model network assets, services, and their relationships across large OSS/BSS deployments; the flaw sits in the 'Security' component, meaning it is a flaw in UIM's own authorization or access-control enforcement rather than in an underlying third-party library. Oracle assigns no CWE in the provided data, but the CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N describes the classic access-control weakness class: an authenticated low-privileged actor interacting locally with the running infrastructure can reach data outside their intended scope, with unchanged scope (S:U) meaning the vulnerable component itself remains the security authority. Because attack complexity is low and no user interaction is needed, the barrier is purely the local foothold and prior valid credentials; impact caps at partial confidentiality loss with no write or denial-of-service effect, and the CVSS 3.1 base score of 3.3 reflects that bounding.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Vendor description confirms local logon (AV:L) with low privileges (PR:L) and only partial read access, so C:L with I:N/A:N and no scope change.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Communications Unified Inventory Management product of Oracle Communications (component: Security). Supported versions that are affected are 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0 and 8.0.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Unified Inventory Management executes to compromise Oracle Communications Unified Inventory Management. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Communications Unified Inventory Management accessible data. CVSS 3.1 Base Score 3.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB