CVE-2026-46981
Full vulnerability record from the local CVENow database.
Description
Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: Mobile). Supported versions that are affected are 2.5.0.1.0-2.5.0.1.17, 2.5.0.2.0-2.5.0.2.11, 2.6.0.1.0-2.6.0.1.12, 2.6.0.2.0-2.6.0.2.8 and 25.12.0.0.0-25.12.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Utilities Network Management System. While the vulnerability is in Oracle Utilities Network Management System, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Utilities Network Management System accessible data as well as unauthorized read access to a subset of Oracle Utilities Network Management System accessible data. CVSS 3.1 Base Score 7.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).
Severity
HIGH
CVSS score
7.2
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2026-07-21 22:17:03.123000
Last modified
2026-10-24 19:10:00.127000
View original CVE JSON
{
"id": "CVE-2026-46981",
"sourceIdentifier": "[email protected]",
"published": "2026-07-21T22:17:03.123",
"lastModified": "2026-10-24T19:10:00.127",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: Mobile). Supported versions that are affected are 2.5.0.1.0-2.5.0.1.17, 2.5.0.2.0-2.5.0.2.11, 2.6.0.1.0-2.6.0.1.12, 2.6.0.2.0-2.6.0.2.8 and 25.12.0.0.0-25.12.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Utilities Network Management System. While the vulnerability is in Oracle Utilities Network Management System, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Utilities Network Management System accessible data as well as unauthorized read access to a subset of Oracle Utilities Network Management System accessible data. CVSS 3.1 Base Score 7.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N)."
},
{
"lang": "es",
"value": "Vulnerabilidad en el producto Oracle Utilities Network Management System de Oracle Utilities Applications (componente: Mobile). Las versiones compatibles afectadas son 2.5.0.1.0-2.5.0.1.17, 2.5.0.2.0-2.5.0.2.11, 2.6.0.1.0-2.6.0.1.12, 2.6.0.2.0-2.6.0.2.8 y 25.12.0.0.0-25.12.0.0.2. La vulnerabilidad fácilmente explotable permite a un atacante no autenticado con acceso a la red vía HTTP comprometer Oracle Utilities Network Management System. Aunque la vulnerabilidad está en Oracle Utilities Network Management System, los ataques pueden tener un impacto significativo en productos adicionales (cambio de alcance). Los ataques exitosos de esta vulnerabilidad pueden resultar en acceso no autorizado de actualización, inserción o eliminación a algunos de los datos accesibles de Oracle Utilities Network Management System, así como acceso de lectura no autorizado a un subconjunto de los datos accesibles de Oracle Utilities Network Management System. Puntuación Base CVSS 3.1 de 7.2 (impactos en la Confidencialidad e Integridad). Vector CVSS: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N)."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Oracle Corporation",
"product": "Oracle Utilities Network Management System",
"versions": [
{
"version": "2.5.0.1.0",
"lessThanOrEqual": "2.5.0.1.17",
"versionType": "custom",
"status": "affected"
},
{
"version": "2.5.0.2.0",
"lessThanOrEqual": "2.5.0.2.11",
"versionType": "custom",
"status": "affected"
},
{
"version": "2.6.0.1.0",
"lessThanOrEqual": "2.6.0.1.12",
"versionType": "custom",
"status": "affected"
},
{
"version": "2.6.0.2.0",
"lessThanOrEqual": "2.6.0.2.8",
"versionType": "custom",
"status": "affected"
},
{
"version": "25.12.0.0.0",
"lessThanOrEqual": "25.12.0.0.2",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 3.9,
"impactScore": 2.7
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-07-22T19:26:07.217977Z",
"id": "CVE-2026-46981",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-284"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:oracle:utilities_network_management_system:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.5.0.1.0",
"versionEndIncluding": "2.5.0.1.17",
"matchCriteriaId": "47DCAB30-358E-4DB7-8F7D-FB19D6C8FBA9"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:oracle:utilities_network_management_system:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.5.0.2.0",
"versionEndIncluding": "2.5.0.2.11",
"matchCriteriaId": "A1609300-ED11-4A07-9D36-C2BDB538759C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:oracle:utilities_network_management_system:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.6.0.1.0",
"versionEndIncluding": "2.6.0.1.12",
"matchCriteriaId": "46324CF0-069F-4FFD-89D0-4D01E77F3866"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:oracle:utilities_network_management_system:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.6.0.2.0",
"versionEndIncluding": "2.6.0.2.8",
"matchCriteriaId": "A9CE392B-E95A-4443-ADC0-EE19710D8554"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:oracle:utilities_network_management_system:*:*:*:*:*:*:*:*",
"versionStartIncluding": "25.12.0.0.0",
"versionEndIncluding": "25.12.0.0.2",
"matchCriteriaId": "57E3EAD4-00B2-4E1B-BA00-D50EF25CAB73"
}
]
}
]
}
],
"references": [
{
"url": "https://www.oracle.com/security-alerts/cpujul2026.html",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}