CVE-2026-46948
MediumCVSS 4.6Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
Vulnerability in Oracle Utilities Network Management System (Security component) allows a low-privileged attacker via HTTP to gain unauthorized read and modify access to data. Requires user interaction.
Risk Assessment
Risk of unauthorized data access and modification in the network management system.
Recommendation
Apply the patch provided by Oracle for the affected versions (2.4.0.1.0-2.4.0.1.32, 2.5.0.1.0-2.5.0.1.17, 2.5.0.2.0-2.5.0.2.11, 2.6.0.2.0-2.6.0.2.7, 25.12.0.0.0).
Other vulnerabilities in Oracle Utilities Network Management System
See all- CVE-2026-101605Medium
Vulnerability in Oracle Utilities Network Management System (System Wide component) affects versions 2.4.0.1.0-2.4.0.1.33, 2.5.0.1.0-2.5.0.1.18, 2.5.0.2.0-2.5.0.2.11, 2.6.0.1.0-2.6.0.1.12, 2.6.0.2.0-2.6.0.2.10 and 25.12.0.0.0-25.12.0.0.2. An easily exploitable network attack by an unauthenticated attacker can result in unauthorized read access to a subset of data.
- CVE-2026-101589Medium
Vulnerability in Oracle Utilities Network Management System (component System Wide) affecting versions 2.6.0.1.0-2.6.0.1.12, 2.6.0.2.0-2.6.0.2.10 and 25.12.0.0.0-25.12.0.0.2. Allows unauthenticated attacker with network access via HTTPS to gain unauthorized read access to a subset of system data.
- CVE-2026-101517Medium
Vulnerability in Oracle Utilities Network Management System (component: System Wide) affects multiple supported versions. An easily exploitable flaw allows a low-privileged attacker with logon to the infrastructure to gain unauthorized access to critical data or complete access to all system data.
- CVE-2026-83343High
Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: System Wide). Affected versions are 2.5.0.2.0-2.5.0.2.13, 2.6.0.1.0-2.6.0.12B, 2.6.0.2.0-2.6.0.2.10A and 25.12.0.0.0-25.12.0.0.3. An easily exploitable vulnerability allows an unauthenticated attacker with network access via HTTP to compromise the system, resulting in unauthorized access to critical data and unauthorized update, insert or delete access to some data.
- CVE-2026-83342High
Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: System Wide). Affected versions are 2.4.0.1.0-2.4.0.1.33, 2.5.0.1.0-2.5.0.1.19, 2.5.0.2.0-2.5.0.2.13, 2.6.0.1.0-2.6.0.12B, 2.6.0.2.0-2.6.0.2.10A and 25.12.0.0.0-25.12.0.0.3. An easily exploitable vulnerability allows a low privileged attacker with logon to the infrastructure to compromise the system.
- CVE-2026-46981High
Vulnerability in Oracle Utilities Network Management System (component: Mobile) in multiple versions. Easily exploitable, allows an unauthenticated attacker via HTTP to unauthorized update, insert, delete, or read part of the data. May affect other products (scope change).
Original NVD description (English source)
Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: Security). Supported versions that are affected are 2.4.0.1.0-2.4.0.1.32, 2.5.0.1.0-2.5.0.1.17, 2.5.0.2.0-2.5.0.2.11, 2.6.0.2.0-2.6.0.2.7 and 25.12.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Utilities Network Management System. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Utilities Network Management System accessible data as well as unauthorized read access to a subset of Oracle Utilities Network Management System accessible data. CVSS 3.1 Base Score 4.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS