CVE-2026-46981

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-46981", "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85", "state": "PUBLISHED", "assignerShortName": "oracle", "dateReserved": "2026-05-18T15:55:10.315Z", "datePublished": "2026-07-21T21:32:51.156Z", "dateUpdated": "2026-07-23T15:17:16.766Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "43595867-4340-4103-b7a2-9a5208d29a85", "shortName": "oracle", "dateUpdated": "2026-07-21T21:32:51.156Z"}, "problemTypes": [{"descriptions": [{"lang": "en-US", "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Utilities Network Management System. While the vulnerability is in Oracle Utilities Network Management System, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Utilities Network Management System accessible data as well as unauthorized read access to a subset of Oracle Utilities Network Management System accessible data."}]}], "affected": [{"vendor": "Oracle Corporation", "product": "Oracle Utilities Network Management System", "versions": [{"version": "2.5.0.1.0", "status": "affected", "lessThanOrEqual": "2.5.0.1.17", "versionType": "custom"}, {"version": "2.5.0.2.0", "status": "affected", "lessThanOrEqual": "2.5.0.2.11", "versionType": "custom"}, {"version": "2.6.0.1.0", "status": "affected", "lessThanOrEqual": "2.6.0.1.12", "versionType": "custom"}, {"version": "2.6.0.2.0", "status": "affected", "lessThanOrEqual": "2.6.0.2.8", "versionType": "custom"}, {"version": "25.12.0.0.0", "status": "affected", "lessThanOrEqual": "25.12.0.0.2", "versionType": "custom"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:oracle:utilities_network_management_system:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.5.0.1.0", "versionEndIncluding": "2.5.0.1.17"}, {"vulnerable": true, "criteria": "cpe:2.3:a:oracle:utilities_network_management_system:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.5.0.2.0", "versionEndIncluding": "2.5.0.2.11"}, {"vulnerable": true, "criteria": "cpe:2.3:a:oracle:utilities_network_management_system:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.0.1.0", "versionEndIncluding": "2.6.0.1.12"}, {"vulnerable": true, "criteria": "cpe:2.3:a:oracle:utilities_network_management_system:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.0.2.0", "versionEndIncluding": "2.6.0.2.8"}, {"vulnerable": true, "criteria": "cpe:2.3:a:oracle:utilities_network_management_system:*:*:*:*:*:*:*:*", "versionStartIncluding": "25.12.0.0.0", "versionEndIncluding": "25.12.0.0.2"}]}]}], "descriptions": [{"lang": "en-US", "value": "Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: Mobile). Supported versions that are affected are 2.5.0.1.0-2.5.0.1.17, 2.5.0.2.0-2.5.0.2.11, 2.6.0.1.0-2.6.0.1.12, 2.6.0.2.0-2.6.0.2.8 and 25.12.0.0.0-25.12.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Utilities Network Management System. While the vulnerability is in Oracle Utilities Network Management System, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Utilities Network Management System accessible data as well as unauthorized read access to a subset of Oracle Utilities Network Management System accessible data. CVSS 3.1 Base Score 7.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N)."}], "references": [{"url": "https://www.oracle.com/security-alerts/cpujul2026.html", "name": "Oracle Advisory", "tags": ["vendor-advisory"]}], "metrics": [{"cvssV3_1": {"attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE", "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "baseScore": 7.2, "baseSeverity": "HIGH"}}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-284", "lang": "en", "description": "CWE-284 Improper Access Control"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-22T19:26:07.217977Z", "id": "CVE-2026-46981", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-23T15:17:16.766Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-46981", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-22T19:26:07.217977Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284 Improper Access Control"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-23T15:14:43.146Z"}}], "cna": {"metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "Oracle Corporation", "product": "Oracle Utilities Network Management System", "versions": [{"status": "affected", "version": "2.5.0.1.0", "versionType": "custom", "lessThanOrEqual": "2.5.0.1.17"}, {"status": "affected", "version": "2.5.0.2.0", "versionType": "custom", "lessThanOrEqual": "2.5.0.2.11"}, {"status": "affected", "version": "2.6.0.1.0", "versionType": "custom", "lessThanOrEqual": "2.6.0.1.12"}, {"status": "affected", "version": "2.6.0.2.0", "versionType": "custom", "lessThanOrEqual": "2.6.0.2.8"}, {"status": "affected", "version": "25.12.0.0.0", "versionType": "custom", "lessThanOrEqual": "25.12.0.0.2"}]}], "references": [{"url": "https://www.oracle.com/security-alerts/cpujul2026.html", "name": "Oracle Advisory", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en-US", "value": "Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: Mobile). Supported versions that are affected are 2.5.0.1.0-2.5.0.1.17, 2.5.0.2.0-2.5.0.2.11, 2.6.0.1.0-2.6.0.1.12, 2.6.0.2.0-2.6.0.2.8 and 25.12.0.0.0-25.12.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Utilities Network Management System. While the vulnerability is in Oracle Utilities Network Management System, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Utilities Network Management System accessible data as well as unauthorized read access to a subset of Oracle Utilities Network Management System accessible data. CVSS 3.1 Base Score 7.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N)."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "description": "Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Utilities Network Management System. While the vulnerability is in Oracle Utilities Network Management System, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Utilities Network Management System accessible data as well as unauthorized read access to a subset of Oracle Utilities Network Management System accessible data."}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:oracle:utilities_network_management_system:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "2.5.0.1.17", "versionStartIncluding": "2.5.0.1.0"}, {"criteria": "cpe:2.3:a:oracle:utilities_network_management_system:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "2.5.0.2.11", "versionStartIncluding": "2.5.0.2.0"}, {"criteria": "cpe:2.3:a:oracle:utilities_network_management_system:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "2.6.0.1.12", "versionStartIncluding": "2.6.0.1.0"}, {"criteria": "cpe:2.3:a:oracle:utilities_network_management_system:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "2.6.0.2.8", "versionStartIncluding": "2.6.0.2.0"}, {"criteria": "cpe:2.3:a:oracle:utilities_network_management_system:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "25.12.0.0.2", "versionStartIncluding": "25.12.0.0.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "43595867-4340-4103-b7a2-9a5208d29a85", "shortName": "oracle", "dateUpdated": "2026-07-21T21:32:51.156Z"}}}, "cveMetadata": {"cveId": "CVE-2026-46981", "state": "PUBLISHED", "dateUpdated": "2026-07-23T15:17:16.766Z", "dateReserved": "2026-05-18T15:55:10.315Z", "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85", "datePublished": "2026-07-21T21:32:51.156Z", "assignerShortName": "oracle"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Oracle Utilities Network Management System", "vendor": "Oracle Corporation", "versions": [{"lessThanOrEqual": "2.5.0.1.17", "status": "affected", "version": "2.5.0.1.0", "versionType": "custom"}, {"lessThanOrEqual": "2.5.0.2.11", "status": "affected", "version": "2.5.0.2.0", "versionType": "custom"}, {"lessThanOrEqual": "2.6.0.1.12", "status": "affected", "version": "2.6.0.1.0", "versionType": "custom"}, {"lessThanOrEqual": "2.6.0.2.8", "status": "affected", "version": "2.6.0.2.0", "versionType": "custom"}, {"lessThanOrEqual": "25.12.0.0.2", "status": "affected", "version": "25.12.0.0.0", "versionType": "custom"}]}], "source": "secalert_us@oracle.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:oracle:utilities_network_management_system:*:*:*:*:*:*:*:*", "matchCriteriaId": "47DCAB30-358E-4DB7-8F7D-FB19D6C8FBA9", "versionEndIncluding": "2.5.0.1.17", "versionStartIncluding": "2.5.0.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:utilities_network_management_system:*:*:*:*:*:*:*:*", "matchCriteriaId": "A1609300-ED11-4A07-9D36-C2BDB538759C", "versionEndIncluding": "2.5.0.2.11", "versionStartIncluding": "2.5.0.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:utilities_network_management_system:*:*:*:*:*:*:*:*", "matchCriteriaId": "46324CF0-069F-4FFD-89D0-4D01E77F3866", "versionEndIncluding": "2.6.0.1.12", "versionStartIncluding": "2.6.0.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:utilities_network_management_system:*:*:*:*:*:*:*:*", "matchCriteriaId": "A9CE392B-E95A-4443-ADC0-EE19710D8554", "versionEndIncluding": "2.6.0.2.8", "versionStartIncluding": "2.6.0.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:utilities_network_management_system:*:*:*:*:*:*:*:*", "matchCriteriaId": "57E3EAD4-00B2-4E1B-BA00-D50EF25CAB73", "versionEndIncluding": "25.12.0.0.2", "versionStartIncluding": "25.12.0.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: Mobile). Supported versions that are affected are 2.5.0.1.0-2.5.0.1.17, 2.5.0.2.0-2.5.0.2.11, 2.6.0.1.0-2.6.0.1.12, 2.6.0.2.0-2.6.0.2.8 and 25.12.0.0.0-25.12.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Utilities Network Management System. While the vulnerability is in Oracle Utilities Network Management System, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Utilities Network Management System accessible data as well as unauthorized read access to a subset of Oracle Utilities Network Management System accessible data. CVSS 3.1 Base Score 7.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N)."}, {"lang": "es", "value": "Vulnerabilidad en el producto Oracle Utilities Network Management System de Oracle Utilities Applications (componente: Mobile). Las versiones compatibles afectadas son 2.5.0.1.0-2.5.0.1.17, 2.5.0.2.0-2.5.0.2.11, 2.6.0.1.0-2.6.0.1.12, 2.6.0.2.0-2.6.0.2.8 y 25.12.0.0.0-25.12.0.0.2. La vulnerabilidad f\u00e1cilmente explotable permite a un atacante no autenticado con acceso a la red v\u00eda HTTP comprometer Oracle Utilities Network Management System. Aunque la vulnerabilidad est\u00e1 en Oracle Utilities Network Management System, los ataques pueden tener un impacto significativo en productos adicionales (cambio de alcance). Los ataques exitosos de esta vulnerabilidad pueden resultar en acceso no autorizado de actualizaci\u00f3n, inserci\u00f3n o eliminaci\u00f3n a algunos de los datos accesibles de Oracle Utilities Network Management System, as\u00ed como acceso de lectura no autorizado a un subconjunto de los datos accesibles de Oracle Utilities Network Management System. Puntuaci\u00f3n Base CVSS 3.1 de 7.2 (impactos en la Confidencialidad e Integridad). Vector CVSS: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N)."}], "id": "CVE-2026-46981", "lastModified": "2026-10-24T19:10:00.127", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.7, "source": "secalert_us@oracle.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-46981", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-22T19:26:07.217977Z", "version": "2.0.3"}}]}, "published": "2026-07-21T22:17:03.123", "references": [{"source": "secalert_us@oracle.com", "tags": ["Vendor Advisory"], "url": "https://www.oracle.com/security-alerts/cpujul2026.html"}], "sourceIdentifier": "secalert_us@oracle.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-284"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[2.5.0.1.0,2.5.0.1.17]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[2.5.0.2.0,2.5.0.2.11]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[2.6.0.1.0,2.6.0.1.12]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[2.6.0.2.0,2.6.0.2.8]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[25.12.0.0.0,25.12.0.0.2]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Oracle Utilities Network Management System", "source": "cna", "vendor": "Oracle Corporation"}, "product": "utilities_network_management_system", "vendor": "oracle"}], "created": "2026-07-23T00:30:03.665291+00:00", "updated": "2026-08-04T18:00:14.120629+00:00", "vendors": ["oracle", "oracle$PRODUCT$utilities_network_management_system"]}