This vulnerability allows an unauthenticated attacker to exfiltrate a subset of data exposed by the Oracle Utilities Network Management System over HTTPS. The impact is a confidentiality breach, where sensitive information accessible through the system can be read without proper authorization. No denial of service or integrity damage is indicated by the description.

Oracle Utilities Network Management System is affected across multiple release lines, specifically versions 2.4.0.1.0 through 2.4.0.1.33, 2.5.0.1.0 through 2.5.0.1.18, 2.5.0.2.0 through 2.5.0.2.11, 2.6.0.1.0 through 2.6.0.1.12, 2.6.0.2.0 through 2.6.0.2.10, and 25.12.0.0.0 through 25.12.0.0.2.

With a CVSS 3.1 Base Score of 5.3, the vulnerability represents moderate risk. The exploit requires only network access to the HTTPS endpoint; no authentication or interactive user involvement is needed. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog, implying lower immediate exploitation pressure but still warranting attention. An attacker could leverage this weakness to read confidential data that should not be publicly visible, potentially compromising customer data and regulatory compliance.