This vulnerability in Oracle Utilities Network Management System (component: System Wide) allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful exploitation can lead to unauthorized access to critical data or complete access to all accessible data, as well as unauthorized update, insert, or delete access to some data. The affected versions include 2.5.0.2.0 through 2.5.0.2.13, 2.6.0.1.0 through 2.6.0.12B, 2.6.0.2.0 through 2.6.0.2.10A, and 25.12.0.0.0 through 25.12.0.0.3. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, reflecting network attack vector, low attack complexity, no privileges or user interaction required, with high confidentiality and low integrity impacts, and no availability impact. Oracle has included a fix for this vulnerability in their September 2026 Critical Security Patch Update.

An attacker can remotely exploit this vulnerability without authentication to gain unauthorized access to critical data within Oracle Utilities Network Management System. The attacker can also perform unauthorized modifications such as update, insert, or delete operations on some accessible data. This compromises confidentiality and integrity of the system's data but does not impact availability.

Oracle has released security patches for this vulnerability in the September 2026 Critical Security Patch Update. It is strongly recommended that customers apply these patches promptly to mitigate the risk. Oracle advises remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.