CVE-2026-101517
MediumCVSS 5.5Summary
Vulnerability in Oracle Utilities Network Management System (component: System Wide) affects multiple supported versions. An easily exploitable flaw allows a low-privileged attacker with logon to the infrastructure to gain unauthorized access to critical data or complete access to all system data.
Risk Assessment
An attacker with local access could gain access to sensitive system data, potentially leading to information disclosure. The risk affects organizations using Oracle Utilities Network Management System versions 2.4.0.1.0-2.4.0.1.33, 2.5.0.1.0-2.5.0.1.18, 2.5.0.2.0-2.5.0.2.11, 2.6.0.1.0-2.6.0.1.12, 2.6.0.2.0-2.6.0.2.9 and 25.12.0.0.0-25.12.0.0.2.
Recommendation
Apply the security updates provided by Oracle for the supported versions. Restrict access to the system infrastructure to trusted users only.
Other vulnerabilities in Oracle Utilities Network Management System
See all- CVE-2026-101605Medium
Vulnerability in Oracle Utilities Network Management System (System Wide component) affects versions 2.4.0.1.0-2.4.0.1.33, 2.5.0.1.0-2.5.0.1.18, 2.5.0.2.0-2.5.0.2.11, 2.6.0.1.0-2.6.0.1.12, 2.6.0.2.0-2.6.0.2.10 and 25.12.0.0.0-25.12.0.0.2. An easily exploitable network attack by an unauthenticated attacker can result in unauthorized read access to a subset of data.
- CVE-2026-101589Medium
Vulnerability in Oracle Utilities Network Management System (component System Wide) affecting versions 2.6.0.1.0-2.6.0.1.12, 2.6.0.2.0-2.6.0.2.10 and 25.12.0.0.0-25.12.0.0.2. Allows unauthenticated attacker with network access via HTTPS to gain unauthorized read access to a subset of system data.
- CVE-2026-83343High
Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: System Wide). Affected versions are 2.5.0.2.0-2.5.0.2.13, 2.6.0.1.0-2.6.0.12B, 2.6.0.2.0-2.6.0.2.10A and 25.12.0.0.0-25.12.0.0.3. An easily exploitable vulnerability allows an unauthenticated attacker with network access via HTTP to compromise the system, resulting in unauthorized access to critical data and unauthorized update, insert or delete access to some data.
- CVE-2026-83342High
Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: System Wide). Affected versions are 2.4.0.1.0-2.4.0.1.33, 2.5.0.1.0-2.5.0.1.19, 2.5.0.2.0-2.5.0.2.13, 2.6.0.1.0-2.6.0.12B, 2.6.0.2.0-2.6.0.2.10A and 25.12.0.0.0-25.12.0.0.3. An easily exploitable vulnerability allows a low privileged attacker with logon to the infrastructure to compromise the system.
- CVE-2026-46981High
Vulnerability in Oracle Utilities Network Management System (component: Mobile) in multiple versions. Easily exploitable, allows an unauthenticated attacker via HTTP to unauthorized update, insert, delete, or read part of the data. May affect other products (scope change).
- CVE-2026-46948Medium
Vulnerability in Oracle Utilities Network Management System (Security component) allows a low-privileged attacker via HTTP to gain unauthorized read and modify access to data. Requires user interaction.
Original NVD description (English source)
Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: System Wide). Supported versions that are affected are 2.4.0.1.0-2.4.0.1.33, 2.5.0.1.0-2.5.0.1.18, 2.5.0.2.0-2.5.0.2.11, 2.6.0.1.0-2.6.0.1.12, 2.6.0.2.0-2.6.0.2.9 and 25.12.0.0.0-25.12.0.0.2. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Utilities Network Management System executes to compromise Oracle Utilities Network Management System. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Utilities Network Management System accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS