{"id":"CVE-2026-91612","kind":"vulnerability","aliases":["CVE-2026-91612"],"related":[],"title":"Oracle Unified Inventory Management: local low-privilege user reads some data","description":"Vulnerability in the Oracle Communications Unified Inventory Management product of Oracle Communications (component: Security).  Supported versions that are affected are 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0 and 8.0.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Unified Inventory Management executes to compromise Oracle Communications Unified Inventory Management.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of Oracle Communications Unified Inventory Management accessible data. CVSS 3.1 Base Score 3.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).","summary":"Oracle Communications Unified Inventory Management versions 7.5.0 through 8.0.1 contain a flaw in the Security component. A local user with low privileges and logon access to the host can read a subset of the application's data.","severity":"low","cvss":3.3,"epss":0.00112,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["on-prem","oracle-communications","unified-inventory-management","vendor"],"not_affected_if":["no-local-logon","unaffected-version"],"how_to_check":"- Check the installed Unified Inventory Management version against the affected list (7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0, 8.0.1)\n- Review which accounts have logon access to the hosts running the application: unknown","fix":"- Apply the Oracle Critical Patch Update that addresses this CVE for Unified Inventory Management: unknown (the sources do not name a patched version)","status":"open","published_at":"2026-10-20T22:21:01+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T04:45:59+00:00","updated_at":"2026-10-25T04:45:59+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-25T04:45:59Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update that addresses this CVE for Unified Inventory Management: unknown (the sources do not name a patched version)","reach":"local","title":"Oracle Unified Inventory Management: local low-privilege user reads some data","impact":"low","summary":"Oracle Communications Unified Inventory Management versions 7.5.0 through 8.0.1 contain a flaw in the Security component. A local user with low privileges and logon access to the host can read a subset of the application's data.","category":"vendor","nicknames":[],"who_cares":["oracle-communications","unified-inventory-management","on-prem"],"confidence":0.7,"needs_auth":"yes","worst_case":"Local low-privilege user reads a subset of application data","analyst_note":"Confirm the patched version and Oracle CPU advisory for CVE-2026-91612 at the NVD link; the sources do not give a fix.","how_to_check":"- Check the installed Unified Inventory Management version against the affected list (7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0, 8.0.1)\n- Review which accounts have logon access to the hosts running the application: unknown","needs_analyst":true,"not_affected_if":["unaffected-version","no-local-logon"],"who_is_affected":"Teams running Oracle Communications Unified Inventory Management in the affected versions, where local users with low privileges can log on to the host or infrastructure. The sources describe no internet-facing path. Teams on other versions or without local logon access to the host are likely not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000643,"input_tokens":3555,"output_tokens":575,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-91612':15A,18A '/av':153C '3.1':143C,152C '3.3':146C '7.5.0':36B,87C '7.5.1':88C '7.6.0':89C '7.7.0':90C '7.8.0':91C '8.0.1':38B,93C 'access':54B,130C,140C 'affect':85C 'allow':97C 'applic':64B 'attack':100C,121C 'base':144C 'communic':24B,31B,71C,78C,108C,116C,136C 'compon':45B,79C 'compromis':114C 'confidenti':147C 'contain':39B 'cve':13A,16A 'cvss':142C,149C,151C 'data':12A,66B,141C 'easili':94C 'execut':112C 'exploit':95C 'flaw':41B 'host':57B 'impact':148C 'infrastructur':105C 'inventori':3A,27B,33B,73C,110C,118C,138C 'l/ac':154C 'l/i':159C 'l/pr':155C 'l/ui':156C 'local':5A,47B 'logon':53B,102C 'low':7A,50B,98C 'low-privileg':6A 'manag':4A,28B,34B,74C,111C,119C,139C 'n':161C 'n/a':160C 'n/s':157C 'on-prem':19B 'oracl':1A,23B,30B,70C,77C,107C,115C,135C 'oracle-commun':22B 'prem':21B 'privileg':8A,51B,99C 'product':75C 'read':10A,59B,129C 'result':126C 'score':145C 'secur':44B,80C 'subset':61B,133C 'success':120C 'support':81C 'u/c':158C 'unauthor':128C 'unifi':2A,26B,32B,72C,109C,117C,137C 'unified-inventory-manag':25B 'user':9A,48B 'vector':150C 'vendor':29B 'version':35B,82C 'vulner':67C,96C,124C","nicknames":[],"mitigations":[],"who_affected":"Teams running Oracle Communications Unified Inventory Management in the affected versions, where local users with low privileges can log on to the host or infrastructure. The sources describe no internet-facing path. Teams on other versions or without local logon access to the host are likely not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:21:01+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91612","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91612","severity":null,"published_at":"2026-10-20T22:21:01+00:00","modified_at":"2026-10-21T18:44:55+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-91612","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91612","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}