The vulnerability CVE-2026-46980 exists in the Mobile component of Oracle Utilities Network Management System. It affects supported versions 2.5.0.1.0 through 2.5.0.1.17, 2.5.0.2.0 through 2.5.0.2.11, 2.6.0.1.0 through 2.6.0.1.12, 2.6.0.2.0 through 2.6.0.2.8, and 25.12.0.0.0 through 25.12.0.0.2. The vulnerability allows a low privileged attacker with network access via HTTP to compromise the system by unauthorized reading of a subset of accessible data. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and limited confidentiality impact without integrity or availability impact. No known exploits in the wild have been reported. The vendor advisory does not explicitly confirm a patch or remediation level for this vulnerability as of the July 2026 update.

Successful exploitation results in unauthorized read access to a subset of data accessible by the Oracle Utilities Network Management System. The impact is limited to confidentiality with no integrity or availability effects. The vulnerability is exploitable remotely over HTTP by a low privileged attacker, making it a moderate risk for data exposure within affected environments.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly once available and remaining on actively supported versions. Until a patch is confirmed, restrict network access to the affected Oracle Utilities Network Management System instances where possible to reduce exposure.