CVE-2026-46980
Analyzed Analyzed - Analysis Complete

Information Disclosure in Oracle Utilities Network Management System

Publication date: 2026-07-21

Last updated on: 2026-08-06

Assigner: Oracle

Description
Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: Mobile). Supported versions that are affected are 2.5.0.1.0-2.5.0.1.17, 2.5.0.2.0-2.5.0.2.11, 2.6.0.1.0-2.6.0.1.12, 2.6.0.2.0-2.6.0.2.8 and 25.12.0.0.0-25.12.0.0.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Utilities Network Management System. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Utilities Network Management System accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-21
Last Modified
2026-08-06
Generated
2026-08-11
AI Q&A
2026-07-22
EPSS Evaluated
2026-08-09
NVD
CVE-2026-46980
EUVD
EUVD-2026-46469

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
oracle utilities_network_management_system From 2.5.0.1.0 (inc) to 2.5.0.1.17 (inc)
oracle utilities_network_management_system From 2.5.0.2.0 (inc) to 2.5.0.2.11 (inc)
oracle utilities_network_management_system From 2.6.0.1.0 (inc) to 2.6.0.1.12 (inc)
oracle utilities_network_management_system From 2.6.0.2.0 (inc) to 2.6.0.2.8 (inc)
oracle utilities_network_management_system From 25.12.0.0.0 (inc) to 25.12.0.0.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a vulnerability in Oracle Utilities Network Management System affecting versions 2.5.0.1.0-2.5.0.1.17, 2.5.0.2.0-2.5.0.2.11, 2.6.0.1.0-2.6.0.1.12, 2.6.0.2.0-2.6.0.2.8 and 25.12.0.0.0-25.12.0.0.2. It allows a low-privileged attacker with network access via HTTP to read a subset of system data without authorization.

Detection Guidance

This vulnerability can be detected by checking for unauthorized network access to the Oracle Utilities Network Management System via HTTP. Monitor logs for unusual HTTP requests targeting the Mobile component. Ensure the system is updated to a patched version.

Impact Analysis

An attacker could gain unauthorized access to sensitive data within the Oracle Utilities Network Management System, potentially exposing confidential information such as system configurations or operational data.

Compliance Impact

This vulnerability allows unauthorized read access to a subset of Oracle Utilities Network Management System data, which could lead to exposure of sensitive information. This may impact compliance with regulations like GDPR (data protection) and HIPAA (health data privacy) if the exposed data falls under their scope.

Mitigation Strategies

Apply the latest security patches from Oracle for the affected versions of Oracle Utilities Network Management System. Ensure network access controls restrict HTTP access to only trusted sources. Monitor network traffic for unusual activity targeting the HTTP interface.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-46980. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart