{"id":"CVE-2026-101589","kind":"vulnerability","aliases":["CVE-2026-101589"],"related":[],"title":"Oracle Utilities Network Management System: unauthenticated read of a subset of data","description":"Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: System Wide).  Supported versions that are affected are 2.6.0.1.0-2.6.0.1.12, 2.6.0.2.0-2.6.0.2.10 and  25.12.0.0.0-25.12.0.0.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Utilities Network Management System.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Utilities Network Management System accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).","summary":"Oracle Utilities Network Management System has a flaw in its System Wide component that lets an unauthenticated attacker reach it over HTTPS. A successful attack gives read access to a subset of the data the product stores.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["network-management-system","oracle-utilities","package","self-hosted"],"not_affected_if":["version-outside-range"],"how_to_check":"- Check the installed Oracle Utilities Network Management System version against the affected ranges: `2.6.0.1.0` through `2.6.0.1.12`, `2.6.0.2.0` through `2.6.0.2.10`, and `25.12.0.0.0` through `25.12.0.0.2`.","fix":"- Move Oracle Utilities Network Management System to a release newer than the affected ranges, using the patch from Oracle's July 2026 advisory or the vendor's patch channel. Exact fixed version: unknown.","status":"open","published_at":"2026-10-20T22:18:12+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T04:23:15+00:00","updated_at":"2026-10-25T04:23:15+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:23:15Z","model":"claude-haiku-5-5","output":{"fix":"- Move Oracle Utilities Network Management System to a release newer than the affected ranges, using the patch from Oracle's July 2026 advisory or the vendor's patch channel. Exact fixed version: unknown.","reach":"internet","title":"Oracle Utilities Network Management System: unauthenticated read of a subset of data","impact":"low","summary":"Oracle Utilities Network Management System has a flaw in its System Wide component that lets an unauthenticated attacker reach it over HTTPS. A successful attack gives read access to a subset of the data the product stores.","category":"package","nicknames":[],"who_cares":["oracle-utilities","network-management-system","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Unauthenticated attacker reads a subset of stored application data","analyst_note":"Confirm the fixed version and patch link from Oracle's security advisory; the NVD entry does not list them.","how_to_check":"- Check the installed Oracle Utilities Network Management System version against the affected ranges: `2.6.0.1.0` through `2.6.0.1.12`, `2.6.0.2.0` through `2.6.0.2.10`, and `25.12.0.0.0` through `25.12.0.0.2`.","needs_analyst":true,"not_affected_if":["version-outside-range"],"who_is_affected":"Teams running Oracle Utilities Network Management System in the affected version ranges with HTTPS reachable from their network are exposed. The sources do not describe a non-default configuration that is required. Teams not running this product, or running a version outside the listed ranges, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000648,"input_tokens":3517,"output_tokens":592,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101589':15A,18A '-2026':14A,17A '/av':147C '2.6.0.1.0':89C '2.6.0.1.12':90C '2.6.0.2.0':91C '2.6.0.2.10':92C '25.12.0.0.0':94C '25.12.0.0.2':95C '3.1':137C,146C '5.3':140C 'access':57B,104C,124C,134C 'affect':87C 'allow':99C 'applic':79C 'attack':47B,54B,101C,115C 'base':138C 'compon':42B,80C 'compromis':108C 'confidenti':141C 'cve':13A,16A 'cvss':136C,143C,145C 'data':12A,63B,135C 'easili':96C 'exploit':97C 'flaw':37B 'give':55B 'host':29B 'https':51B,106C 'impact':142C 'l/i':153C 'l/pr':149C 'let':44B 'manag':4A,21B,33B,73C,112C,132C 'n':155C 'n/a':154C 'n/ac':148C 'n/s':151C 'n/ui':150C 'network':3A,20B,32B,72C,103C,111C,131C 'network-management-system':19B 'oracl':1A,24B,30B,70C,77C,109C,129C 'oracle-util':23B 'packag':26B 'product':65B,75C 'reach':48B 'read':7A,56B,123C 'result':120C 'score':139C 'self':28B 'self-host':27B 'store':66B 'subset':10A,60B,127C 'success':53B,114C 'support':83C 'system':5A,22B,34B,40B,74C,81C,113C,133C 'u/c':152C 'unauthent':6A,46B,100C 'unauthor':122C 'util':2A,25B,31B,71C,78C,110C,130C 'vector':144C 'version':84C 'via':105C 'vulner':67C,98C,118C 'wide':41B,82C","nicknames":[],"mitigations":[],"who_affected":"Teams running Oracle Utilities Network Management System in the affected version ranges with HTTPS reachable from their network are exposed. The sources do not describe a non-default configuration that is required. Teams not running this product, or running a version outside the listed ranges, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101589","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101589","severity":null,"published_at":"2026-10-20T22:18:12+00:00","modified_at":"2026-10-21T18:43:53+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}