CVE-2026-46980: Oracle Utilities NMS Information Disclosure

CVE-2026-46980 Overview

CVE-2026-46980 is an access control weakness [CWE-284] in the Mobile component of Oracle Utilities Network Management System (NMS), part of Oracle Utilities Applications. A low-privileged attacker with network access via HTTP can compromise the system and gain unauthorized read access to a subset of NMS data. The issue affects versions 2.5.0.1.0-2.5.0.1.17, 2.5.0.2.0-2.5.0.2.11, 2.6.0.1.0-2.6.0.1.12, 2.6.0.2.0-2.6.0.2.8, and 25.12.0.0.0-25.12.0.0.2. Oracle addressed the flaw in the July 2026 Critical Patch Update.

Critical Impact
Authenticated attackers can read a subset of Oracle Utilities NMS data over HTTP without user interaction, exposing operational information handled by the Mobile component.

Affected Products

Oracle Utilities Network Management System 2.5.0.1.0 through 2.5.0.1.17
Oracle Utilities Network Management System 2.5.0.2.0 through 2.5.0.2.11, and 2.6.0.1.0 through 2.6.0.1.12
Oracle Utilities Network Management System 2.6.0.2.0 through 2.6.0.2.8, and 25.12.0.0.0 through 25.12.0.0.2

Discovery Timeline

2026-07-21 - CVE-2026-46980 published to NVD following Oracle's July 2026 Critical Patch Update
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-46980

Vulnerability Analysis

CVE-2026-46980 resides in the Mobile component of Oracle Utilities NMS, which supports field crew interactions with the outage and distribution management platform. Oracle classifies the flaw as easily exploitable over the network via HTTP. Exploitation only requires low-privilege authentication and no user interaction. Successful exploitation produces unauthorized read access to a subset of NMS data, with no direct impact on integrity or availability. The scope remains unchanged, meaning the compromise is confined to the vulnerable component's security context.

Root Cause

The issue is categorized under [CWE-284] Improper Access Control. The Mobile component fails to fully enforce authorization checks on one or more request paths, allowing a caller with valid low-privilege credentials to reach data intended for higher-privileged roles. Oracle has not published implementation details, and no public proof-of-concept exists.

Attack Vector

The attacker requires network reachability to an HTTP endpoint exposed by the NMS Mobile component and a valid low-privileged account. From there, the attacker issues crafted HTTP requests to endpoints that return data the account should not be permitted to view. Because the Mobile component often serves field-facing traffic, exposure grows when the endpoints are accessible from broader network segments or the public internet.

Refer to the Oracle July 2026 Critical Patch Update Advisory for vendor-provided technical details.

Detection Methods for CVE-2026-46980

Indicators of Compromise

Repeated HTTP requests from a single authenticated session enumerating record identifiers or resource paths within the NMS Mobile component.
Unusual volumes of successful 2xx responses returning record data to accounts with limited operational roles.
Access to Mobile component endpoints from IP ranges or user agents that do not match known field-crew devices.

Detection Strategies

Correlate NMS Mobile access logs with identity provider logs to flag low-privilege accounts retrieving data outside their assigned territories or crew scope.
Baseline per-role request patterns against the Mobile API and alert on deviations in endpoint diversity or response size.
Hunt for sequential identifier access patterns that suggest scripted enumeration against Mobile endpoints.

Monitoring Recommendations

Forward web server, application, and authentication logs from all NMS Mobile tiers to a centralized analytics platform for retention and correlation.
Enable verbose authorization decision logging in the Mobile component so denied and allowed access events are both captured.
Monitor account privilege changes and new account creation in the NMS identity store, especially for accounts that immediately access Mobile endpoints.

How to Mitigate CVE-2026-46980

Immediate Actions Required

Apply the fixes from the Oracle July 2026 Critical Patch Update to all affected NMS deployments.
Inventory NMS instances against the affected version list and prioritize internet-exposed and multi-tenant environments.
Rotate credentials for low-privileged NMS accounts and review recent Mobile component access for anomalous reads.

Patch Information

Oracle released remediation for CVE-2026-46980 as part of the July 2026 Critical Patch Update. Administrators should upgrade Oracle Utilities Network Management System to a version above the affected ranges listed by Oracle. Consult the vendor advisory for the specific patch identifier that applies to each supported version stream.

Workarounds

Restrict network access to the NMS Mobile component endpoints using firewalls, VPNs, or reverse proxies until patches are deployed.
Enforce least-privilege role assignments and remove unused low-privileged accounts that could be leveraged as an authenticated foothold.
Require multi-factor authentication for all accounts capable of reaching NMS Mobile endpoints to raise the cost of credential misuse.

bash

# Example: restrict access to the NMS Mobile endpoint to trusted field networks
# Replace 10.20.30.0/24 with the CIDR range used by authorized field devices
iptables -A INPUT -p tcp --dport 443 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP