CVE-2026-83343

Deferred Deferred - Pending Action

Unauthenticated Access in Oracle Utilities Network Management System

Publication date: 2026-09-15

Last updated on: 2026-09-21

Assigner: Oracle

Description

Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: System Wide). Supported versions that are affected are 2.5.0.2.0-2.5.0.2.13, 2.6.0.1.0-2.6.0.12B, 2.6.0.2.0-2.6.0.2.10A and 25.12.0.0.0-25.12.0.0.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Utilities Network Management System. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Utilities Network Management System accessible data as well as unauthorized update, insert or delete access to some of Oracle Utilities Network Management System accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-21

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-83343

EUVD

EUVD-2026-79696

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	utilities_network_management_system	From 2.5.0.2.0 (inc) to 2.5.0.2.13 (inc)
oracle	utilities_network_management_system	From 2.6.0.1.0 (inc) to 2.6.0.12B (inc)
oracle	utilities_network_management_system	From 2.6.0.2.0 (inc) to 2.6.0.2.10A (inc)
oracle	utilities_network_management_system	From 25.12.0.0.0 (inc) to 25.12.0.0.3 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Utilities Network Management System where an unauthenticated attacker can remotely access the system via HTTP. It allows unauthorized access to critical data or complete access to all system data, as well as unauthorized modifications to some data. The CVSS score is 8.2, indicating high severity for confidentiality and moderate for integrity.

Detection Guidance

This vulnerability can be detected by checking for exposed Oracle Utilities Network Management System instances on your network. Look for HTTP services running on default ports (typically 80 or 443) and verify if the system version matches affected releases (2.5.0.2.0-2.5.0.2.13, 2.6.0.1.0-2.6.0.12B, 2.6.0.2.0-2.6.0.2.10A, or 25.12.0.0.0-25.12.0.0.3). Use network scanning tools like nmap to identify such services.

Impact Analysis

If exploited, this vulnerability could allow attackers to steal sensitive data, alter system data, or delete data without authorization. This could disrupt critical infrastructure operations if the system is used for managing utilities like electricity or water.

Compliance Impact

This vulnerability allows unauthorized access to critical data and complete access to all accessible data, which could lead to violations of data protection regulations like GDPR and HIPAA. Unauthorized data modification or deletion further exacerbates compliance risks by compromising data integrity and confidentiality.

Mitigation Strategies

Immediately apply the latest security patches from Oracle for affected versions of Oracle Utilities Network Management System. If patches are not available, consider isolating the system from untrusted networks or disabling HTTP access until updates are applied.

Hi! I’m here to help you understand CVE-2026-83343. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70