Oracle Communications UIM EUVD-2026-47306

Exploitation requires network access to UIM over HTTP and a valid low-privilege account on the target instance (PR:L) - it is not anonymous/pre-authentication despite the 'Authentication Bypass' tag, which appears to describe authorization escalation from a low-privilege position rather than fully unauthenticated entry. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so no special timing, race, or non-default configuration is called out in the description. The main limiting factors are the requirement for a low-privilege credential and HTTP reachability of the UIM Security component; instances exposed only to trusted internal networks and with tightly controlled account provisioning present a materially smaller attack surface. Affected deployments are UIM versions 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0, and 8.0.1.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) describes a network-reachable, low-complexity attack needing only low privileges and no user interaction, with high confidentiality impact and low integrity impact - a genuine data-exposure concern that Oracle itself labels 'easily exploitable.' However, real-world urgency signals are limited: EPSS is not provided, there is no public exploit identified at time of analysis, and it is not in CISA KEV, so there is no evidence of active or automated exploitation. The primary limiting factor is PR:L - an attacker must already hold some valid low-privilege access to the UIM instance, which reduces exposure to purely internal or credentialed adversaries rather than anonymous internet-wide attackers. The 'Authentication Bypass' tag partially conflicts with the PR:L rating (a true pre-auth bypass would imply PR:N); this discrepancy should be verified against Oracle's advisory, as the tag may describe an authorization-escalation effect reached from a low-privilege foothold rather than fully unauthenticated access.

A user or attacker holding a low-privilege UIM account (or credentials for one) sends crafted HTTP requests to the Security component and, exploiting the authorization weakness, reads inventory and configuration data across the entire instance and makes limited unauthorized modifications. No public proof-of-concept is available, and the low attack complexity (AC:L) means that once a valid low-privilege foothold exists, the request sequence to trigger the flaw is straightforward.