EUVD-2026-106806
GHSA-c263-6ccr-ccxv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local logon
-
ExploitAccess vulnerable Security component
-
ImpactRead unauthorized subset of UIM data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already have a valid low-privileged local logon to the infrastructure/host where Oracle Communications Unified Inventory Management executes (CVSS AV:L, PR:L) - this is not remotely reachable and cannot be triggered by an unauthenticated network attacker. No user interaction is needed (UI:N). The principal limiting factors are the mandatory local access and pre-existing authenticated account, which together confine exploitation to insiders or attackers who have already gained a foothold; impact is further limited to read-only access to a subset of data (C:L, no integrity or availability effect). |
| Impact | This is a low-severity, low-priority issue despite warranting tracking in a telecom OSS environment. The CVSS 3.1 base score is 3.3 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - exploitation requires LOCAL access (the attacker must already have a logon to the infrastructure where Oracle Communications Unified Inventory Management runs) and low-level privileges, and the only impact is limited (C:L) unauthorized read access to a subset of accessible data. There is no integrity or availability impact. EPSS is not provided in the input, the CVE is not listed in CISA KEV, and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis. The combination of a local attack vector, required authentication, and read-only partial confidentiality impact makes this a genuinely low real-world risk rather than a high-CVSS-but-overrated item - it is already correctly scored low. Note a metadata conflict: the input Tags include 'Authentication Bypass,' but the CVSS vector (PR:L) and description ('low privileged attacker with logon') describe an authenticated information-disclosure flaw, NOT an authentication bypass - the tag appears mislabeled and should be verified. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged local logon to the server hosting Oracle Communications Unified Inventory Management leverages the Security-component flaw to read a subset of inventory data they should not have access to. No user interaction is required, but the attacker must first possess valid local access to the host. No public proof-of-concept is referenced in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
Oracle Communications Unified Inventory Management (versions 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0 and 8.0.1) contains a low-severity confidentiality flaw in its Security component that lets a low-privileged attacker who already holds a valid local logon to the hosting infrastructure read a subset of application data. The attack is local only (AV:L, PR:L, UI:N) with no integrity or availability impact, so exposure is confined to insiders or attackers who have already established a foothold on the host. No public exploit code or CISA KEV active-exploitation signal was identified at time of analysis, and EPSS-style risk is correspondingly modest given the mandatory local access and pre-existing account.
RemediationAI
Apply the Oracle Communications Unified Inventory Management fixes published in the October 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpuoct2026.html), which is the authoritative source for the exact patched build per affected line (7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0, 8.0.1); an exact fix version is not stated in the available data, so confirm the target build against that advisory before upgrading and treat any earlier build as unpatched. Because exploitation requires local logon with a valid low-privileged account, the highest-value compensating controls are host-level: restrict interactive logon to the UIM infrastructure to a small administrative group (for example, tighten SSH/sudo policy and OS account provisioning), remove or disable shared and service accounts, and enable session auditing so unauthorized local reads are logged - the trade-off is reduced operational convenience for support staff who currently share host access. Where the application exposes role-based data visibility, review and least-privilege existing UIM user roles so that low-privileged accounts cannot reach the affected data subset, accepting that overly restrictive roles may break legitimate inventory workflows. Monitor the Oracle advisory for the assigned patched builds and schedule the upgrade rather than relying on network segmentation alone, since the vector is local and segmentation does not mitigate insider access.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue sits in the Security component of Oracle Communications Unified Inventory Management, a telecom OSS inventory and service-resource management platform used to track network assets, services and their relationships. The root cause class is not formally assigned a CWE in the supplied data, but the CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) with only a confidentiality-low impact indicates an access-control or information-exposure weakness rather than memory corruption: a low-privileged authenticated local user can reach data they should not see, without altering it or disrupting service. Because the vector is AV:L with PR:L, exploitation is not network-reachable and requires an existing account on the host running the product; there is no user-interaction requirement and scope is unchanged, so the flaw cannot be chained to escape the application's security authority on its own. Oracle's CPU metadata tags the record under Authentication Bypass, suggesting the underlying defect permits circumvention of an intended authorization or authentication check to disclose a limited data subset rather than full application compromise.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Requires an authenticated local logon (AV:L, PR:L) with no user interaction; impact is read-only partial confidentiality (C:L) with no integrity or availability effect.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Communications Unified Inventory Management product of Oracle Communications (component: Security). Supported versions that are affected are 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0 and 8.0.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Unified Inventory Management executes to compromise Oracle Communications Unified Inventory Management. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Communications Unified Inventory Management accessible data. CVSS 3.1 Base Score 3.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB