Oracle Utilities NMS EUVD-2026-106013

No special configuration conditions are stated in the description - exploitation requires only network reachability to the Oracle Utilities Network Management System HTTPS interface by an unauthenticated attacker (AV:N/AC:L/PR:N/UI:N), affecting versions 2.4.0.1.0-2.4.0.1.33, 2.5.0.1.0-2.5.0.1.18, 2.5.0.2.0-2.5.0.2.11, 2.6.0.1.0-2.6.0.1.12, 2.6.0.2.0-2.6.0.2.10, and 25.12.0.0.0-25.12.0.0.2. The primary LIMITING factor is scope of impact: successful attacks yield only read access to a SUBSET of data (C:L, I:N, A:N), so there is no code execution, data modification, or service disruption. Real-world exposure is further constrained because NMS is typically a segmented operational-technology/utility back-office system rather than an internet-facing application, so network reachability by an external attacker is often not the default.

This is a medium-severity information-disclosure flaw (CVSS 3.1 base 5.3) in Oracle Utilities Network Management System, confirmed by the Oracle October 2026 Critical Patch Update (cpuoct2026.html). The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N indicates remote, low-complexity, unauthenticated exploitation over the network with no user interaction, which raises its real-world accessibility; however, impact is limited strictly to unauthorized read access to a SUBSET of data (C:L), with no integrity or availability impact. Oracle characterizes it as 'easily exploitable,' consistent with AC:L, but no EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no evidence of active exploitation or weaponization. The practical prioritization signals conflict: the vector is attacker-friendly (network, unauthenticated) but the technical impact is low and confined, so this is better treated as a routine CPU-cycle patch for affected Oracle Utilities operators rather than an emergency. Note a data conflict: the input Tag 'Authentication Bypass' does not match the described behavior (partial unauthorized read access / information disclosure), which should be verified against Oracle's advisory. EPSS/KEV/POC data are absent (not necessarily zero) and should be re-checked as the CPU matures.

A remote, unauthenticated attacker sends crafted HTTPS requests to an internet- or network-reachable Oracle Utilities Network Management System instance and retrieves a subset of application data they should not be able to access, without needing credentials or user interaction. No public exploit code is identified at time of analysis, but the low attack complexity (AC:L) and lack of authentication (PR:N) make opportunistic probing feasible. The exposure is limited to confidentiality of a data subset, not full system compromise.