CVE-2026-61095 affects Oracle Communications Unified Inventory Management (versions 7.5.0 through 8.0.1). It is an easily exploitable vulnerability that allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation can lead to unauthorized access to critical or all accessible data and unauthorized modification (update, insert, delete) of some data. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) reflects network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. The vendor advisory references a Critical Patch Update released in July 2026 but does not explicitly state patch availability or remediation for this vulnerability.

The vulnerability allows unauthorized access to critical and potentially all accessible data within Oracle Communications Unified Inventory Management and unauthorized modification of some data. This compromises confidentiality and integrity of the system's data. There is no reported impact on availability. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to the affected product and monitor for suspicious activity related to unauthorized data access or modification.