This vulnerability exists in the Mobile component of Oracle Utilities Network Management System versions 2.5.0.1.0 through 2.5.0.1.17, 2.5.0.2.0 through 2.5.0.2.11, 2.6.0.1.0 through 2.6.0.1.12, 2.6.0.2.0 through 2.6.0.2.8, and 25.12.0.0.0 through 25.12.0.0.2. It allows an unauthenticated attacker with network access via HTTP to compromise the system, resulting in unauthorized update, insert, or delete access to some data, and unauthorized read access to a subset of data. The vulnerability has a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, indicating network attack vector, low attack complexity, no privileges or user interaction required, scope change, low confidentiality and integrity impact, and no availability impact. Oracle’s Critical Patch Update advisory for July 2026 references this vulnerability among many others but does not explicitly confirm a dedicated patch or remediation level for this specific issue.

Successful exploitation can lead to unauthorized modification (update, insert, delete) and unauthorized reading of certain data within Oracle Utilities Network Management System. The vulnerability affects confidentiality and integrity but does not impact availability. The scope change indicates that other Oracle products relying on this system may also be impacted. No known exploits in the wild have been reported at this time.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory, which contains numerous security patches across Oracle products. However, no explicit patch or remediation level is confirmed for this specific vulnerability in the advisory. Organizations should review the July 2026 Critical Patch Update documentation and apply all relevant patches promptly. Until a specific patch is confirmed, monitor Oracle advisories for updates. No vendor advisory states that no action is required or that the issue is already mitigated.