{"id":"CVE-2026-101604","kind":"vulnerability","aliases":["CVE-2026-101604"],"related":[],"title":"Oracle Unified Inventory Management: unauthenticated network flaw exposes critical data","description":"Vulnerability in the Oracle Communications Unified Inventory Management product of Oracle Communications (component: Security).  Supported versions that are affected are 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0 and 8.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Inventory Management.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Unified Inventory Management accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","summary":"Oracle Communications Unified Inventory Management versions 7.5.0 through 8.0.1 contain a flaw in the Security component that can be reached over HTTP. An unauthenticated attacker with network access can read critical data and all data the product can access.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["oracle","telecom","unified-inventory-management","vendor"],"not_affected_if":["not-affected-release"],"how_to_check":"- Confirm the installed release of Oracle Communications Unified Inventory Management against the affected list: 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0, 8.0.1.\n- Check whether the HTTP interface is reachable from untrusted networks.","fix":"- Apply the vendor patch from Oracle's Critical Patch Update for the affected release; the sources do not name the fixed version, so unknown.","status":"open","published_at":"2026-10-20T22:18:14+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","triaged_at":"2026-10-25T03:20:16+00:00","updated_at":"2026-10-25T03:20:16+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:20:16Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the vendor patch from Oracle's Critical Patch Update for the affected release; the sources do not name the fixed version, so unknown.","reach":"network","title":"Oracle Unified Inventory Management: unauthenticated network flaw exposes critical data","impact":"high","summary":"Oracle Communications Unified Inventory Management versions 7.5.0 through 8.0.1 contain a flaw in the Security component that can be reached over HTTP. An unauthenticated attacker with network access can read critical data and all data the product can access.","category":"vendor","nicknames":[],"who_cares":["oracle","telecom","unified-inventory-management"],"confidence":0.6,"needs_auth":"no","worst_case":"Unauthenticated attacker reads critical data and all accessible product data.","analyst_note":"Find Oracle's CPU advisory for this CVE to get the fixed version and the exact vulnerable endpoint or configuration.","how_to_check":"- Confirm the installed release of Oracle Communications Unified Inventory Management against the affected list: 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0, 8.0.1.\n- Check whether the HTTP interface is reachable from untrusted networks.","needs_analyst":true,"not_affected_if":["not-affected-release"],"who_is_affected":"Deployments of Oracle Communications Unified Inventory Management in the affected release list that expose their HTTP interface to a network an attacker can reach. The sources do not say which configurations are required, so unknown for default-config exposure. Teams not running this product can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000645,"input_tokens":3500,"output_tokens":590,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-101604':13A,16A '-2026':12A,15A '/av':144C '3.1':134C,143C '7.5':137C '7.5.0':30B,83C '7.5.1':84C '7.6.0':85C '7.7.0':86C '7.8.0':87C '8.0.1':32B,89C 'access':51B,62B,98C,117C,123C,131C 'affect':81C 'allow':93C 'attack':48B,95C,109C 'base':135C 'communic':25B,67C,74C,104C,127C 'complet':122C 'compon':39B,75C 'compromis':102C 'confidenti':138C 'contain':33B 'critic':9A,54B,119C 'cve':11A,14A 'cvss':133C,140C,142C 'data':10A,55B,58B,120C,132C 'easili':90C 'exploit':91C 'expos':8A 'flaw':7A,35B 'h/i':150C 'http':45B,100C 'impact':139C 'inventori':3A,21B,27B,69C,106C,129C 'l/pr':146C 'manag':4A,22B,28B,70C,107C,130C 'n':152C 'n/a':151C 'n/ac':145C 'n/s':148C 'n/ui':147C 'network':6A,50B,97C 'oracl':1A,17B,24B,66C,73C,103C,126C 'product':60B,71C 'reach':43B 'read':53B 'result':114C 'score':136C 'secur':38B,76C 'success':108C 'support':77C 'telecom':18B 'u/c':149C 'unauthent':5A,47B,94C 'unauthor':116C 'unifi':2A,20B,26B,68C,105C,128C 'unified-inventory-manag':19B 'vector':141C 'vendor':23B 'version':29B,78C 'via':99C 'vulner':63C,92C,112C","nicknames":[],"mitigations":[],"who_affected":"Deployments of Oracle Communications Unified Inventory Management in the affected release list that expose their HTTP interface to a network an attacker can reach. The sources do not say which configurations are required, so unknown for default-config exposure. Teams not running this product can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:18:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-101604","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101604","severity":null,"published_at":"2026-10-20T22:18:14+00:00","modified_at":"2026-10-21T18:43:53+00:00","first_seen_at":"2026-10-23T21:57:22+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}