---
id: "CVE-2026-101604"
kind: "vulnerability"
aliases: ["CVE-2026-101604"]
title: "Oracle Unified Inventory Management: unauthenticated network flaw exposes critical data"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["oracle", "telecom", "unified-inventory-management", "vendor"]
not_affected_if: ["not-affected-release"]
published_at: "2026-10-20T22:18:14+00:00"
first_seen_at: "2026-10-23T21:57:22+00:00"
updated_at: "2026-10-25T03:20:16+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101604", "first_seen_at": "2026-10-23T21:57:22+00:00"}]
---

# Oracle Unified Inventory Management: unauthenticated network flaw exposes critical data

Oracle Communications Unified Inventory Management versions 7.5.0 through 8.0.1 contain a flaw in the Security component that can be reached over HTTP. An unauthenticated attacker with network access can read critical data and all data the product can access.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the installed release of Oracle Communications Unified Inventory Management against the affected list: 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0, 8.0.1.
- Check whether the HTTP interface is reachable from untrusted networks.

## Fix

- Apply the vendor patch from Oracle's Critical Patch Update for the affected release; the sources do not name the fixed version, so unknown.

## Timeline

- 2026-10-23T21:57:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101604

## From the sources

Vulnerability in the Oracle Communications Unified Inventory Management product of Oracle Communications (component: Security).  Supported versions that are affected are 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0 and 8.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Communications Unified Inventory Management.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Communications Unified Inventory Management accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_