The Oracle Communications Unified Inventory Management product contains a vulnerability in its security component that allows a local low‑privileged attacker with logon to the infrastructure to read a subset of data managed by the application. The breach results in unauthorized disclosure of confidential information, as the confidentiality dimension is impacted while integrity and availability remain unaffected. This weakness aligns with information‑exposure weaknesses as the attacker can access data they should not see.

The affected product is Oracle Communications Unified Inventory Management. Oracle lists impacted releases 7.5.0 through 7.8.0 and 8.0.1. The vulnerability applies to all instances of these versions running on any supported platform.

The CVSS base score is 3.3, indicating a low‑severity issue with a limited impact on confidentiality. EPSS data is unavailable, and the vulnerability is not included in the CISA KEV catalog, suggesting no widely observed exploitation. The attack vector is local, requiring legitimate logon to the host; therefore, risk is primarily elevated in environments where users can gain local access to the application servers. Administrators should treat the risk as moderate if unpatched hosts exist in a high‑value network.