The vulnerability exists in the Security component of Oracle Communications Unified Inventory Management. A low‑privileged attacker who can log on to the underlying infrastructure can exploit this flaw to read a subset of data exposed by the application. The result is unauthorized disclosure of confidential data, impacting the confidentiality of the system.

Oracle Communications Unified Inventory Management is affected. The product versions 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0, and 8.0.1 are listed as vulnerable in Oracle’s October 2026 security alert.

The CVSS base score of 3.3 indicates low severity, yet the flaw is described as easily exploitable by any user who can log onto the infrastructure. Because the attack requires only local access and low privilege, the practical risk remains significant. EPSS is not available, and the vulnerability is not in the CISA KEV catalog, suggesting no known widespread exploitation, but the straightforward local attack path warrants prompt remediation.