EUVD-2026-46465
GHSA-qq2j-mj4g-j78r
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Network-delivered via HTTP with low-complexity; low-privilege authentication required and victim interaction needed; limited read/write data impact with no availability effect.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: Security). Supported versions that are affected are 2.4.0.1.0-2.4.0.1.32, 2.5.0.1.0-2.5.0.1.17, 2.5.0.2.0-2.5.0.2.11, 2.6.0.2.0-2.6.0.2.7 and 25.12.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Utilities Network Management System. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Utilities Network Management System accessible data as well as unauthorized read access to a subset of Oracle Utilities Network Management System accessible data. CVSS 3.1 Base Score 4.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N).
AnalysisAI
Unauthorized data access and manipulation in Oracle Utilities Network Management System exposes the Security component across five supported release trains to network-based exploitation by low-privileged authenticated users. A successful attack requires human interaction from a victim other than the attacker, enabling partial confidentiality and integrity compromise - specifically unauthorized read access to a subset of NMS data and unauthorized insert, update, or delete operations. No public exploit code exists and this CVE is not listed in the CISA KEV catalog at time of analysis; the 'Authentication Bypass' tag in source intelligence appears to describe privilege escalation within the application rather than full authentication circumvention, given the CVSS PR:L metric.
Technical ContextAI
Oracle Utilities Network Management System (NMS) is an operational technology platform used by electric utility operators for grid management and outage response. The affected component is the Security module, which governs access control and authorization within the application. CPE cpe:2.3:a:oracle_corporation:oracle_utilities_network_management_system covers all tracked versions. The CVSS vector (AV:N/AC:L/PR:L/UI:R) places the attack surface on the HTTP-exposed web interface. CWE is listed as N/A by NVD, but the 'Authentication Bypass' tag from source intelligence suggests a broken object-level authorization or improper privilege management flaw - where a low-privileged authenticated user can access or modify data objects belonging to other users or higher privilege tiers. The UI:R constraint implies the attack path likely involves crafting a malicious URL or request that a victim must interact with, consistent with a cross-site or session-based exploitation pattern.
RemediationAI
Apply Oracle's Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. Exact patched version numbers are not independently confirmed beyond the CPU advisory reference; contact Oracle support to confirm the target version for each installed release train. As a compensating control pending patching, restrict access to the NMS web interface to only the minimum set of authenticated users required for operations, and enforce network segmentation to limit HTTP access to trusted internal networks only - reducing exposure of the authentication surface. Monitor NMS access logs for anomalous low-privileged account activity, particularly attempts to access data objects outside the user's normal scope. Note that access restriction does not eliminate the vulnerability but reduces the pool of potential attackers given the PR:L requirement.
Unauthenticated network compromise of Oracle Utilities Network Management System (Mobile component) allows remote attack
Unauthorized data read in Oracle Utilities Network Management System's Mobile component allows low-privileged, network-a
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today