CVE-2026-91613: Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Unified Inventory Management executes to compromise Oracle Communications Unified Inventory Management. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Communications Unified Inventory Management accessible data. in Oracle Corporation Oracle Communications Unified Inventory Management

This vulnerability affects Oracle Communications Unified Inventory Management (versions 7.5.0 through 8.0.1) and allows a low privileged attacker who already has logon access to the infrastructure to compromise the product by gaining unauthorized read access to a subset of accessible data. The CVSS 3.1 base score is 3.3, reflecting a low severity impact focused on confidentiality. Oracle's October 2026 Critical Patch Update advisory references this vulnerability among 1295 security patches released. The advisory emphasizes the importance of applying patches without delay to prevent exploitation.

Successful exploitation results in unauthorized read access to a subset of data within Oracle Communications Unified Inventory Management. There is no impact on data integrity or availability. The attacker must have low privileged logon access to the infrastructure where the product runs. The overall severity is low.

Oracle has released security patches for this vulnerability as part of its October 2026 Critical Patch Update. Customers should apply these official patches promptly. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to prevent exploitation. No alternative mitigations or workarounds are specified in the advisory.