Oracle Utilities NMS EUVD-2026-46465

Exploitation requires the attacker to hold a valid low-privileged account in Oracle Utilities NMS (PR:L per CVSS). Additionally, a separate human victim who is an NMS user must perform some interaction - such as clicking a link or loading a crafted page - meaning purely automated exploitation is not feasible (UI:R). Attack is delivered over HTTP via the network (AV:N), so direct local access is not required, but the attacker must have network reachability to the NMS HTTP interface. The impact is scoped to NMS-accessible data only (S:U), limiting lateral movement. Exploitation is bounded to NMS environments where multiple users with differing privilege levels share access to the same instance. No special non-default configuration is indicated as required.

The CVSS 3.1 base score of 4.6 (Medium) reflects meaningful but bounded risk: AV:N and AC:L indicate the vulnerability is easily reachable over HTTP with no special conditions, but PR:L requires the attacker to already hold a valid low-privileged account, and UI:R means a victim must be socially engineered into some interaction - both meaningful friction points. Impact is limited to partial confidentiality and integrity (C:L/I:L) with no availability loss (A:N), capping the blast radius. No EPSS data was provided in the intelligence sources, so exploitation probability cannot be numerically quantified. The CVE is not in the CISA KEV catalog and no POC is identified, suggesting no confirmed active exploitation. The 'Authentication Bypass' tag is potentially misleading relative to the CVSS PR:L metric - if true authentication bypass (PR:N) were achievable, the score would be significantly higher; this inconsistency should be verified against Oracle's full advisory detail. Overall, this is a genuine but lower-priority finding appropriate for inclusion in the next planned Oracle CPU patching cycle rather than emergency remediation.

A low-privileged NMS operator account holder crafts a malicious HTTP request or link targeting the Security component's authorization logic and distributes it to a higher-privileged NMS user via internal email or a shared interface element. When the victim interacts with the crafted content, the attacker's session gains access to read data records outside their authorization scope and can submit unauthorized data modifications - such as altering network topology records or outage event entries - within the NMS platform.