This vulnerability exists in the Security Component of Oracle Communications Unified Inventory Management. It is easily exploitable remotely over HTTP without authentication, enabling attackers to compromise the system and access sensitive data. The affected versions explicitly include 7.5.0 to 7.5.1, 7.6.0 to 7.8.0, and 8.0.1. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms network attack vector, low complexity, no privileges or user interaction needed, and high confidentiality impact with no integrity or availability impact. Oracle has published this vulnerability as part of its August 2026 Critical Security Patch Update, which includes numerous patches across many products. However, no direct patch link or specific patch version for this vulnerability was provided in the advisory content.

Successful exploitation results in unauthorized access to critical or all accessible data within Oracle Communications Unified Inventory Management. This compromises confidentiality but does not affect integrity or availability. The vulnerability can be exploited remotely without authentication, increasing risk exposure.

Oracle strongly recommends applying the August 2026 Critical Security Patch Update, which addresses this vulnerability among many others. Customers should remain on actively supported versions and promptly apply available security patches to mitigate this risk. Since no specific patch link was provided, users must consult the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for detailed patch availability and installation instructions. No alternative mitigations or workarounds are indicated in the advisory.