Oracle UIM EUVD-2026-62084

Exploitation requires only HTTP network access to an Oracle Communications Unified Inventory Management instance running one of the affected versions (7.5.0-7.5.1, 7.6.0-7.8.0, or 8.0.1). The CVSS vector PR:N/AC:L/UI:N confirms that no authentication, no special configuration, and no user interaction are needed - the bypass is effective against standard deployments of the affected versions. Limiting factors include: UIM is predominantly deployed as an internal enterprise application in telecom operator environments rather than being directly internet-facing, which raises the bar for external attackers but not for authenticated network insiders or post-compromise lateral movement; the vulnerability is confined to confidentiality impact (I:N, A:N), so it cannot be used directly for data modification or service disruption.

The CVSS 3.1 score of 7.5 (High) is well-calibrated to the threat: an unauthenticated attacker over the network with low complexity and no user interaction can exfiltrate all data the application can access. The Authentication Bypass tag reinforces that this is not a partial information leak but a full security control bypass. No EPSS data was provided in the available intelligence, which limits probabilistic exploitation forecasting; similarly, absence from CISA KEV suggests no confirmed in-the-wild exploitation at time of analysis, providing some temporary risk reduction. However, even a mid-sized municipal IT team in tczew running UIM for regional telecom asset tracking should treat this as urgent, since the zero-prerequisite exploitation conditions mean that any network-reachable instance is fully exposed. The sole limiting factor in real-world impact is deployment topology: UIM is typically an internal enterprise platform rather than an internet-facing application, which reduces the external attack surface but does not eliminate risk from insider threats or lateral-movement scenarios. No POC is known, but AC:L means development of working exploit code is not technically demanding.

An unauthenticated attacker with HTTP access to an Oracle UIM instance crafts a request to the Security Component endpoint, bypassing authentication controls without supplying credentials. The attacker receives a successful response containing inventory data - potentially including network topology maps, physical resource assignments, service configurations, and customer-linked data - that should require authentication to access. No public exploit code has been identified at time of analysis, but the network-accessible, zero-credential, low-complexity nature of the attack suggests that once a researcher identifies the specific bypass mechanism, weaponization would be rapid.