← Vulnerability feed

Vulnerability record · CVE-2026-46980 · published 21 July 2026

CVE-2026-46980: Oracle utilities network management system improper access control vulnerability

Oracle · Utilities Network Management System

Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: Mobile). Supported versions that are affected are 2.5.0.1.0-2.5.0.1.17, 2.5.0.2.0-2.5.0.2.11, 2.6.0.1.0-2.6.0.1.12, 2.6.0.2.0-2.6.0.2.8 and 25.12.0.0.0-25.12.0.0.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Utilities Network Management System. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Utilities Network Management System accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).

4.3 CVSS 3.1 Medium EPSS 0.27% · top 82.4% CWE-284 · Improper access control
4.3CVSS 3.1 base score
0.27%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References
6 Aug 2026Last modified by NVD

Description

Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: Mobile). Supported versions that are affected are 2.5.0.1.0-2.5.0.1.17, 2.5.0.2.0-2.5.0.2.11, 2.6.0.1.0-2.6.0.1.12, 2.6.0.2.0-2.6.0.2.8 and 25.12.0.0.0-25.12.0.0.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Utilities Network Management System. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Utilities Network Management System accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.oracle.com/security-alerts/cpujul2026.html Vendor Advisory

Track CVE-2026-46980 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2018-1000613Bouncycastle bc-java vulnerabilityLegion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externall…EPSS 4.8%7.5CVE-2018-3246Oracle banking platform vulnerabilityVulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services). Supported versions that are aff…EPSS 2.9%7.5CVE-2018-11040Vmware spring framework inclusion from untrusted sphere vulnerabilitySpring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-dom…EPSS 3.2%7.2CVE-2026-46981Oracle utilities network management system improper access control vulnerabilityVulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: Mobile). Supported versions that…EPSS 0.27%6.5CVE-2018-1257Vmware spring framework vulnerabilitySpring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP o…EPSS 3.1%5.9CVE-2018-11039Vmware spring framework vulnerabilitySpring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the…EPSS 2.7%4.6CVE-2026-46948Oracle utilities network management system improper access control vulnerabilityVulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: Security). Supported versions th…EPSS 0.21%7.8CVE-2026-81963Windows Update Stack link-following privilege escalationWindows Update Stack resolves links improperly before accessing files, a link-following flaw (CWE-59) compounded by improper access control (CWE-284)…KEVEPSS 0.39%analysed

Source: NIST National Vulnerability Database (record CVE-2026-46980), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.