This vulnerability in Oracle Utilities Network Management System (component: Security) affects versions 2.4.0.1.0 through 2.4.0.1.32, 2.5.0.1.0 through 2.5.0.1.17, 2.5.0.2.0 through 2.5.0.2.11, 2.6.0.2.0 through 2.6.0.2.7, and 25.12.0.0.0. It allows a low privileged attacker with network access via HTTP to compromise the system, requiring user interaction from a third party. The impact includes unauthorized read and write (update, insert, delete) access to some accessible data. The CVSS 3.1 base score is 4.6, reflecting low confidentiality and integrity impacts with no availability impact. The vulnerability is categorized under CWE-284 (Improper Access Control). Oracle's July 2026 Critical Patch Update advisory mentions many patches but does not explicitly confirm a patch for this vulnerability. Customers are urged to apply security patches promptly.

The vulnerability allows unauthorized read access to a subset of accessible data and unauthorized update, insert, or delete operations on some accessible data within Oracle Utilities Network Management System. This compromises confidentiality and integrity of the affected system data. Availability is not impacted. Exploitation requires network access via HTTP and user interaction from a person other than the attacker, limiting the ease of exploitation.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly as part of their Critical Patch Update program to mitigate this and other vulnerabilities. No specific workaround or temporary fix is provided in the advisory.