---
id: "CVE-2026-101517"
kind: "vulnerability"
aliases: ["CVE-2026-101517"]
title: "Oracle Utilities Network Management System: local low-privilege user reads critical data"
severity: "medium"
cvss: 5.5
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["network-management-system", "on-prem", "oracle-utilities", "self-hosted", "vendor"]
not_affected_if: ["no-local-logon", "unaffected-release"]
published_at: "2026-10-20T22:18:00+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-25T04:12:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101517", "first_seen_at": "2026-10-23T21:57:22+00:00"}]
---

# Oracle Utilities Network Management System: local low-privilege user reads critical data

Oracle Utilities Network Management System (System Wide component) has a flaw in several supported release lines, including 2.4.0.1.0 through 2.6.0.2.9 and 25.12.0.0.0 through 25.12.0.0.2. A low-privileged user who can log on to the host running the product can gain unauthorized access to critical data, per the CVSS 5.5 vector (confidentiality high, no integrity or availability impact).

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Identify the installed Oracle Utilities Network Management System release and compare it against the affected ranges listed in the advisory: 2.4.0.1.0-2.4.0.1.33, 2.5.0.1.0-2.5.0.1.18, 2.5.0.2.0-2.5.0.2.11, 2.6.0.1.0-2.6.0.1.12, 2.6.0.2.0-2.6.0.2.9, 25.12.0.0.0-25.12.0.0.2.
- Check which OS accounts can log on to the hosts running the product, since the attack needs a local logon.

## Fix

- Move Oracle Utilities Network Management System to a release outside the affected ranges, using the patch from Oracle's Critical Patch Update for the release line. Fix version: unknown from the sources.
- Until patched, restrict local logon on the application hosts to trusted administrators.

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101517

## From the sources

Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: System Wide).  Supported versions that are affected are 2.4.0.1.0-2.4.0.1.33, 2.5.0.1.0-2.5.0.1.18, 2.5.0.2.0-2.5.0.2.11, 2.6.0.1.0-2.6.0.1.12, 2.6.0.2.0-2.6.0.2.9 and  25.12.0.0.0-25.12.0.0.2. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Utilities Network Management System executes to compromise Oracle Utilities Network Management System.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Utilities Network Management System accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_