This vulnerability in Oracle Communications Unified Inventory Management (component: Third Party) allows an unauthenticated attacker with network access via HTTP to compromise the system. The flaw permits unauthorized creation, deletion, or modification of critical data or all accessible data within the product. Affected versions include 7.5.0, 7.5.1, 7.6.0 through 7.8.0, and 8.0.1. The CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, reflecting network attack vector, high attack complexity, no privileges or user interaction required, and high confidentiality and integrity impact. Oracle's August 2026 Critical Security Patch Update includes fixes for this vulnerability among 943 security patches across multiple products. Oracle advises customers to remain on supported versions and apply patches without delay to mitigate exploitation risks.

An unauthenticated attacker with network access via HTTP could exploit this vulnerability to gain unauthorized creation, deletion, or modification access to critical data or all accessible data within Oracle Communications Unified Inventory Management. This compromises confidentiality and integrity of the data but does not affect availability. The vulnerability is rated high severity with a CVSS score of 7.4. There are no known exploits in the wild at this time.

Oracle has released a Critical Security Patch Update in August 2026 which includes patches addressing this vulnerability. Customers are strongly advised to apply the available security patches promptly and remain on actively supported versions. No additional mitigation steps are indicated by the vendor advisory. Patch status is confirmed by the vendor advisory; applying the official patch is the recommended remediation.