CVE-2026-91612 in Communications Unified Inventory Management
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Communications Unified Inventory Management product of Oracle Communications (component: Security). Supported versions that are affected are 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0 and 8.0.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Communications Unified Inventory Management executes to compromise Oracle Communications Unified Inventory Management. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Communications Unified Inventory Management accessible data. CVSS 3.1 Base Score 3.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The Oracle Communications Unified Inventory Management product, specifically within its Security component across versions 7.5.0 through 8.0.1, contains a vulnerability that permits unauthorized access to sensitive data under specific conditions. This flaw is classified as an easily exploitable security issue that primarily impacts the confidentiality of information stored or processed by the system. The vulnerability allows for low-privileged attackers who have valid logon credentials and network access to the infrastructure hosting Oracle Communications Unified Inventory Management to compromise the integrity of the application's security controls. By leveraging this weakness, an attacker can gain unauthorized read access to a subset of data that should be restricted based on their assigned privilege level. This represents a classic case where authentication mechanisms or authorization checks fail to properly enforce boundaries between different user roles, leading to information disclosure.
From a technical perspective, the vulnerability aligns with CWE-269, which describes Improper Privilege Management, and more specifically points toward CWE-863, as it involves an actor accessing resources they are not explicitly authorized to view despite having legitimate access credentials. The attack vector is local or adjacent network-based rather than remote, requiring the attacker to have some form of authenticated presence on the system where the application executes. This requirement significantly limits the scope of potential exploitation compared to remotely exploitable flaws but does not eliminate risk for organizations with internal threats or compromised low-level accounts. The absence of user interaction in the exploit chain means that once an attacker obtains valid credentials, they can automate the extraction of sensitive data without needing to trick a human operator into performing any actions.
The operational impact of this vulnerability is centered on confidentiality loss rather than integrity or availability disruptions. Successful exploitation results in the exposure of proprietary business logic, customer information, inventory records, or other critical assets managed by the Unified Inventory Management system. For telecommunications and enterprise service providers relying on Oracle Communications for resource management, such data leakage can lead to competitive disadvantage, regulatory non-compliance with standards like GDPR or HIPAA if personal data is involved, and erosion of trust among partners and customers. While the CVSS 3.1 base score of 3.3 indicates a low severity rating due to the limited scope of impact (read-only access) and the requirement for local authentication, the cumulative risk increases significantly in environments where lateral movement from compromised low-privilege accounts is possible or when sensitive intellectual property is stored within the affected data subsets.
Mitigation strategies should focus on both immediate remediation and long-term architectural improvements. Oracle has likely released patches addressing this specific flaw; therefore, applying the latest security updates for all supported versions of Oracle Communications Unified Inventory Management is the primary corrective action. Organizations must ensure that their patch management processes are rigorous enough to deploy these fixes promptly upon release. In addition to patching, implementing strict least-privilege principles across user accounts can reduce the attack surface. This involves auditing existing permissions and ensuring that no account has more access rights than strictly necessary for its function. Furthermore, enhancing monitoring capabilities through Security Information and Event Management systems can help detect anomalous data retrieval patterns associated with this type of exploitation.
From a threat intelligence standpoint, this vulnerability maps to MITRE ATT&CK technique T1078, Valid Accounts, as it relies on legitimate credentials being used for unauthorized purposes. It also relates to T1530, Data from Local System, depending on how the data is accessed and exfiltrated after gaining initial access. Defense-in-depth measures such as network segmentation can isolate Oracle Communications servers from general corporate networks, limiting an attacker's ability to reach the infrastructure even if they compromise a lower-level system elsewhere in the enterprise environment. Regular penetration testing focused on privilege escalation and authorization bypasses will help identify similar weaknesses before malicious actors do. By combining timely patching with robust access control policies and continuous monitoring, organizations can effectively mitigate the risks posed by this vulnerability and maintain the confidentiality of their critical inventory management data.