This vulnerability exists in the System Wide component of Oracle Utilities Network Management System. It is exploitable by an attacker with low privileges who has logon access to the infrastructure where the system runs. Exploitation can result in complete compromise of the Oracle Utilities Network Management System. The affected versions include 2.4.0.1.0 through 2.4.0.1.33, 2.5.0.1.0 through 2.5.0.1.19, 2.5.0.2.0 through 2.5.0.2.13, 2.6.0.1.0 through 2.6.0.12B, 2.6.0.2.0 through 2.6.0.2.10A, and 25.12.0.0.0 through 25.12.0.0.3. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects local attack vector, low complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has released this fix as part of its September 2026 Critical Security Patch Update, which customers are strongly advised to apply promptly.

The vulnerability allows a low privileged attacker who can log on to the infrastructure hosting Oracle Utilities Network Management System to fully compromise the system. This includes complete loss of confidentiality, integrity, and availability of the affected system, potentially resulting in takeover of the Oracle Utilities Network Management System.

Oracle has released a security patch addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply the relevant patches without delay to remediate this vulnerability. Oracle strongly recommends remaining on actively-supported versions and promptly applying security updates to prevent exploitation. No additional mitigation steps are indicated beyond applying the official patch.