This vulnerability affects Oracle Communications Unified Inventory Management (versions 7.5.0 through 8.0.1) and is classified under CWE-284 (Improper Access Control). It enables a low privileged attacker with network access over HTTP to compromise the system, resulting in unauthorized access to critical data or complete data access, as well as unauthorized modification capabilities (update, insert, delete) on some data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) indicates network attack vector, low attack complexity, low privilege required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. The vendor advisory from Oracle’s July 2026 Critical Patch Update mentions this vulnerability but does not explicitly state that a patch is available or provide a remediation level. No known exploits have been reported in the wild.

Successful exploitation can lead to unauthorized access to critical or all accessible data within Oracle Communications Unified Inventory Management, as well as unauthorized ability to update, insert, or delete some data. This compromises confidentiality and partially impacts data integrity. There is no reported impact on availability. The vulnerability can be exploited remotely over HTTP by an attacker with low privileges, increasing the risk of compromise in exposed network environments.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly once available and remaining on actively supported versions. Until a patch is confirmed, restrict network access to Oracle Communications Unified Inventory Management interfaces to trusted users only and monitor for unusual access patterns consistent with unauthorized data access or modification.