CVE-2026-46948
Full vulnerability record from the local CVENow database.
Description
Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: Security). Supported versions that are affected are 2.4.0.1.0-2.4.0.1.32, 2.5.0.1.0-2.5.0.1.17, 2.5.0.2.0-2.5.0.2.11, 2.6.0.2.0-2.6.0.2.7 and 25.12.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Utilities Network Management System. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Utilities Network Management System accessible data as well as unauthorized read access to a subset of Oracle Utilities Network Management System accessible data. CVSS 3.1 Base Score 4.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N).
Severity
MEDIUM
CVSS score
4.6
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2026-07-21 22:17:02.513000
Last modified
2026-10-24 19:10:00.127000
View original CVE JSON
{
"id": "CVE-2026-46948",
"sourceIdentifier": "[email protected]",
"published": "2026-07-21T22:17:02.513",
"lastModified": "2026-10-24T19:10:00.127",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: Security). Supported versions that are affected are 2.4.0.1.0-2.4.0.1.32, 2.5.0.1.0-2.5.0.1.17, 2.5.0.2.0-2.5.0.2.11, 2.6.0.2.0-2.6.0.2.7 and 25.12.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Utilities Network Management System. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Utilities Network Management System accessible data as well as unauthorized read access to a subset of Oracle Utilities Network Management System accessible data. CVSS 3.1 Base Score 4.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N)."
},
{
"lang": "es",
"value": "Vulnerabilidad en el producto Oracle Utilities Network Management System de Oracle Utilities Applications (componente: Seguridad). Las versiones compatibles afectadas son 2.4.0.1.0-2.4.0.1.32, 2.5.0.1.0-2.5.0.1.17, 2.5.0.2.0-2.5.0.2.11, 2.6.0.2.0-2.6.0.2.7 y 25.12.0.0.0. Vulnerabilidad fácilmente explotable permite a un atacante con pocos privilegios con acceso a la red vía HTTP comprometer Oracle Utilities Network Management System. Los ataques exitosos requieren interacción humana de una persona distinta al atacante. Los ataques exitosos de esta vulnerabilidad pueden resultar en acceso no autorizado de actualización, inserción o eliminación a algunos de los datos accesibles de Oracle Utilities Network Management System, así como acceso de lectura no autorizado a un subconjunto de los datos accesibles de Oracle Utilities Network Management System. Puntuación Base CVSS 3.1 de 4.6 (impactos en la Confidencialidad e Integridad). Vector CVSS: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N)."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Oracle Corporation",
"product": "Oracle Utilities Network Management System",
"versions": [
{
"version": "2.4.0.1.0",
"lessThanOrEqual": "2.4.0.1.32",
"versionType": "custom",
"status": "affected"
},
{
"version": "2.5.0.1.0",
"lessThanOrEqual": "2.5.0.1.17",
"versionType": "custom",
"status": "affected"
},
{
"version": "2.5.0.2.0",
"lessThanOrEqual": "2.5.0.2.11",
"versionType": "custom",
"status": "affected"
},
{
"version": "2.6.0.2.0",
"lessThanOrEqual": "2.6.0.2.7",
"versionType": "custom",
"status": "affected"
},
{
"version": "25.12.0.0.0",
"versionType": "semver",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.1,
"impactScore": 2.5
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-07-22T19:21:54.850272Z",
"id": "CVE-2026-46948",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-284"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:oracle:utilities_network_management_system:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.4.0.1.0",
"versionEndIncluding": "2.4.0.1.32",
"matchCriteriaId": "2DB04F20-E669-4A8C-812E-3D9EDC3AD61A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:oracle:utilities_network_management_system:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.5.0.1.0",
"versionEndIncluding": "2.5.0.1.17",
"matchCriteriaId": "47DCAB30-358E-4DB7-8F7D-FB19D6C8FBA9"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:oracle:utilities_network_management_system:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.5.0.2.0",
"versionEndIncluding": "2.5.0.2.11",
"matchCriteriaId": "A1609300-ED11-4A07-9D36-C2BDB538759C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:oracle:utilities_network_management_system:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.6.0.2.0",
"versionEndIncluding": "2.6.0.2.7",
"matchCriteriaId": "D11E7EF6-F799-4BDC-9B18-69076A7639B6"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:oracle:utilities_network_management_system:25.12.0.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "52AE8806-A785-4D95-A0F6-C3AA7BA2F5D6"
}
]
}
]
}
],
"references": [
{
"url": "https://www.oracle.com/security-alerts/cpujul2026.html",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}