Description

Vulnerability in the Oracle Communications Unified Inventory Management product of Oracle Communications (component: Security Component). Supported versions that are affected are 7.5.0-7.5.1, 7.6.0-7.8.0 and 8.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Inventory Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Communications Unified Inventory Management accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-18T21:18:15.140Z",
  "pubdate": "2026-08-18T21:18:15.140Z",
  "executiveSummary": "An unauthenticated, network-accessible vulnerability affects the Security Component of the Oracle Communications Unified Inventory Management product. This security flaw impacts supported product versions 7.5.0-7.5.1, 7.6.0-7.8.0, and 8.0.1. The vulnerability is classified as easily exploitable, allowing remote attackers lacking any prior authentication or credentials to leverage the HTTP protocol to compromise the targeted system. Successful exploitation directly impacts the confidentiality of the environment, resulting in unauthorized access to critical data or complete exposure of all data accessible within the Oracle Communications Unified Inventory Management application. Due to the lack of required privileges and user interaction, the risk implication is significant, exposing sensitive telecommunications and inventory data to malicious actors via standard network interfaces.",
  "technicalDetails": "The vulnerability resides within the Security Component of Oracle Communications Unified Inventory Management across versions 7.5.0-7.5.1, 7.6.0-7.8.0, and 8.0.1. From an architectural perspective, the vulnerable component fails to properly enforce access controls or authenticate incoming requests processed via the HTTP protocol. The attack vector is strictly network-based (AV:N), meaning an adversary does not require physical access or local network presence to initiate an attack. Furthermore, the attack complexity is rated as low (AC:L), indicating that the targeted flaw does not require specialized conditions, race conditions, or complex exploitation chains to succeed.\nDuring an attack, an unauthenticated threat actor (PR:N) with standard network reachability to the Oracle Communications Unified Inventory Management HTTP interface can craft and transmit malicious HTTP requests targeting the vulnerable Security Component. Because the application lacks adequate authorization checks and input validation for these endpoints, the request is processed without verifying the identity or permissions of the sender. This bypasses security boundaries established to protect sensitive backend resources.\nThe post-exploitation impact is exclusively characterized by a high confidentiality violation (C:H), with no direct impact on integrity (I:N) or availability (A:N) as defined by the CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Upon successful request execution, the attacker is granted unauthorized read access to critical business logic data, infrastructure details, and operational inventories managed by the application. The lack of required user interaction (UI:N) ensures that the attack can be fully automated, allowing threat actors to harvest large volumes of sensitive data efficiently through scripted enumeration or direct API calls against the exposed HTTP service."
}