The vulnerability in Oracle Utilities Network Management System permits an attacker to read sensitive data through HTTPS without authentication, resulting in unauthorized disclosure of selected system information. The weakness stems from an insufficient access control or authentication validation, allowing read access to protected data.

Affected versions are 2.6.0.1.0 through 2.6.0.1.12, 2.6.0.2.0 through 2.6.0.2.10, and 25.12.0.0 through 25.12.0.0.2, all belonging to Oracle Corporation’s Oracle Utilities Network Management System.

The CVSS base score of 5.3 reflects moderate severity focused on confidentiality loss. EPSS is not available, so the current exploit probability remains uncertain. The vulnerability is not listed in CISA KEV catalog, indicating no known active exploits. Attackers can exploit the flaw remotely over HTTPS without credentials, making it easily exploitable for unauthenticated data reads.