The vulnerability allows an attacker who has a low‑privileged account with logon to the infrastructure where Oracle Utilities Network Management System (U‑MS) runs to obtain unauthorized access to all data managed by the system. The flaw leads to a confidentiality breach, allowing the attacker to read or obtain sensitive configuration and operational information without having administrative rights. The weakness is an improper access control that permits broader access than intended.

Affected are Oracle Utilities Network Management System 2.4.0.1.0 through 2.4.0.1.33, 2.5.0.1.0 through 2.5.0.1.18, 2.5.0.2.0 through 2.5.0.2.11, 2.6.0.1.0 through 2.6.0.1.12, 2.6.0.2.0 through 2.6.0.2.9, and 25.12.0.0.0 through 25.12.0.0.2.

The CVSS 3.1 base score of 5.5 indicates a medium risk. The exploit requires only local access and low privilege, meaning an attacker with any local logon to the network can exploit it. The EPSS score is not yet available, but the lack of KEV listing suggests no widespread known exploits. The attack vector is likely local network intrusion or compromised workstation carrying a low‑privileged user account, so organizations should consider this risk when designing network segmentation and account privilege models.