EUVD-2026-105997
GHSA-8rhm-cxgv-5266
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach NMS web tier over HTTPS
-
ExploitSend crafted unauthenticated request
-
ExecutionBypass access control on data subset
-
ImpactRead unauthorized application data
Vulnerability Assessment
| Exploitation Conditions | No special conditions beyond network reachability - remote unauthenticated exploitation over HTTPS against the System Wide component of Oracle Utilities Network Management System, with no authentication (PR:N) and no user interaction (UI:N) required per the CVSS vector. Limiting factors: the target NMS HTTPS interface must be network-reachable by the attacker (these are typically internal utility/operations systems, not internet-facing), the deployment must run an affected version (2.6.0.1.0-2.6.0.1.12, 2.6.0.2.0-2.6.0.2.10, or 25.12.0.0.0-25.12.0.0.2), and the impact is confined to reading a subset of application data (C:L) with no write or availability effect. |
| Impact | This is a moderate-severity information-disclosure flaw (CVSS 3.1 base 5.3) whose signals are internally consistent but point to limited real-world urgency. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes an easily exploitable, unauthenticated, network-reachable issue over HTTPS, which raises exposure, but the impact is narrowly scoped: confidentiality-only (C:L), with no integrity (I:N) or availability (A:N) effect, and only 'unauthorized read access to a subset of accessible data' per Oracle's own description. There is NO EPSS score provided, the CVE is NOT on the CISA KEV list, and NO public proof-of-concept is referenced - so this is 'no public exploit identified at time of analysis.' A notable conflict exists in the metadata: the input Tags include 'Authentication Bypass,' yet Oracle's description characterizes the issue as unauthenticated read access to a data subset, not a privilege/authentication-boundary bypass - treat the 'Authentication Bypass' label with caution and verify against the Oracle CPU advisory. Overall this is a real but lower-tier priority: patch in the normal Oracle Critical Patch Update cycle rather than as an emergency, because the limited (partial read) impact and absence of KEV/POC/EPSS signals argue against widespread active exploitation. |
| Exploit ScenarioDerived | An unauthenticated attacker with network reachability to the Oracle Utilities Network Management System web tier sends crafted HTTPS requests to the exposed System Wide component and retrieves a subset of application data they should not be able to read. No proof-of-concept or exploit code is referenced in the provided sources, and the CVSS low attack complexity (AC:L) with no required privileges (PR:N) or user interaction (UI:N) means a working exploit would require no special timing or victim action. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Unauthenticated information disclosure in Oracle Utilities Network Management System lets a remote attacker read a limited subset of application data through the System Wide component's HTTPS interface, with no credentials or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, base 5.3). Only deployments on 2.6.0.1.0 through 2.6.0.1.12, 2.6.0.2.0 through 2.6.0.2.10, and 25.12.0.0.0 through 25.12.0.0.2 are affected, and the impact is confined to confidentiality - no data modification or service disruption is possible. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; EPSS data was not supplied, so real-world urgency is driven mainly by whether the NMS HTTPS interface is reachable from untrusted networks.
RemediationAI
Patch status: Patch available per vendor advisory - Oracle ships this fix in its Critical Patch Update for October 2026 (https://www.oracle.com/security-alerts/cpuoct2026.html), which is the primary remediation; Oracle CPU advisories bundle fixes rather than publishing a per-CVE build number, so confirm the exact NMS patch level against the CPU patch matrix for your 2.6.0.1.x, 2.6.0.2.x, or 25.12.0.0.x line before closing the finding. Until the CPU is applied, the decisive control is reachability: because the vector is PR:N, any host that can open a TCP session to the NMS HTTPS interface can attempt the request, so restrict that interface to control-room and administrative network segments via firewall allowlists, a VPN, or a jump host, and remove any internet or broad-intranet exposure. Trade-off: allowlisting breaks access for remote field engineers and any integration that posts to the same listener, so inventory those clients first and route them through the same controlled path. Additionally, enable and review HTTPS access logs for anonymous or unexpectedly successful requests to System Wide endpoints, since the exploit leaves a readable request trail; this is detection, not prevention, and log retention must be extended long enough to cover the exposure window. Rotate or review any credentials or operational data visible to the affected component's read scope if unauthenticated access to the interface cannot be ruled out for the full exposure period.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Utilities Network Management System is a utility operations platform (distribution/outage management) whose 'System Wide' component provides cross-cutting application services, including web-facing endpoints served over HTTPS. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N describes a straightforward failure of authorization on a reachable HTTPS path: an anonymous client can complete a request that should have required authentication or a higher privilege level, and the response leaks a partial view of application data. No CWE was supplied by the reporter, but the observable behavior (anonymous read of protected data with no state change) is consistent with missing or improperly enforced access control on an application endpoint rather than a memory-safety or injection defect. Because the scope is unchanged and only confidentiality is impacted, the flaw does not chain into code execution or data tampering on its own; its value to an attacker is reconnaissance - leaked identifiers, configuration details, or operational records that can support follow-on targeting. The root cause lives in Oracle's proprietary application code, so exploitability details are opaque without the vendor patch diff; no CPE strings were provided in the feed, so version mapping must come from the Oracle advisory's supported-version ranges.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Unauthenticated remote HTTPS access with low complexity gives AV:N/AC:L/PR:N/UI:N; impact is partial data read only, so C:L and I:N/A:N.
Primary rating from NVD.
CVSS VectorNVD
DescriptionNVD
Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: System Wide). Supported versions that are affected are 2.6.0.1.0-2.6.0.1.12, 2.6.0.2.0-2.6.0.2.10 and 25.12.0.0.0-25.12.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Utilities Network Management System. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Utilities Network Management System accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB