Oracle NMS EUVD-2026-46469

Exploitation requires a valid low-privileged account on the Oracle Utilities NMS system with network access to the Mobile component over HTTP. The CVSS PR:L metric confirms authentication is required - unauthenticated exploitation is not supported by the available data. The 'easily exploitable' designation means no elevated complexity, race conditions, or special configuration beyond a standard installation is required. Limiting factors: the attacker must possess or obtain valid credentials (even low-privilege), the target must be running one of the five affected version ranges, and the Mobile component's HTTP interface must be reachable. Organizations that have network-segmented NMS HTTP interfaces to internal-only networks significantly reduce exposure; those with internet-exposed NMS Mobile endpoints face the highest risk.

The CVSS 3.1 base score of 4.3 (Medium) reflects a constrained impact: confidentiality only, low severity, and a required low-privileged account (PR:L). The 'easily exploitable' designation in Oracle's advisory language is Oracle's standard encoding for AC:L/PR:L/UI:N, meaning no special conditions or race windows are needed once the attacker holds a valid low-privileged account. No EPSS score was provided in the intelligence data, which limits probabilistic exploitation estimation. There is no CISA KEV listing and no known public POC, so real-world exploitation risk is currently speculative. The 'Authentication Bypass' tag creates a tension with PR:L: it may indicate that the low-privileged user can bypass object-level authorization to read data belonging to other users or higher-privilege roles, rather than gaining access without any credentials. This is a meaningful but contained risk - the scope does not change (S:U), and there is no integrity or availability impact. Priority for utilities organizations should be moderate: patch during the next maintenance window rather than emergency response, unless the NMS Mobile component is internet-facing.

An attacker who holds a low-privileged account on an Oracle Utilities NMS instance - for example, a read-only field technician account - sends a crafted HTTP request to the Mobile component that bypasses authorization checks, returning confidential NMS data (such as network topology, asset details, or operational records) belonging to other users or higher-privileged roles. No public exploit code exists at time of analysis, but the 'easily exploitable' classification and AC:L/UI:N vector mean that a working exploit requires minimal sophistication once an account is obtained.