CVE-2026-71142: Oracle UIM Authentication Bypass Vulnerability

CVE-2026-71142 Overview

CVE-2026-71142 is an access control vulnerability [CWE-284] in Oracle Communications Unified Inventory Management. The flaw affects the Security Component and allows unauthenticated attackers with network access via HTTP to compromise the product. Successful exploitation results in unauthorized access to critical data or complete read access to all data accessible through the application.

Oracle rates the vulnerability as easily exploitable and notes no privileges or user interaction are required. Affected versions include 7.5.0-7.5.1, 7.6.0-7.8.0, and 8.0.1.

Critical Impact
Unauthenticated remote attackers can read all data accessible to Oracle Communications Unified Inventory Management over HTTP.

Affected Products

Oracle Communications Unified Inventory Management 7.5.0-7.5.1
Oracle Communications Unified Inventory Management 7.6.0-7.8.0
Oracle Communications Unified Inventory Management 8.0.1

Discovery Timeline

2026-08-18 - CVE-2026-71142 published to NVD
2026-08-20 - Last updated in NVD database
Oracle Security Alert - Published in the Oracle Security Alert Advisory (cspuaug2026)

Technical Details for CVE-2026-71142

Vulnerability Analysis

The vulnerability resides in the Security Component of Oracle Communications Unified Inventory Management. It is classified under [CWE-284] Improper Access Control. The CVSS vector indicates a confidentiality-only impact, with no effect on integrity or availability.

An attacker reaches the vulnerable code path over the network using HTTP requests. Exploitation does not require authentication, credentials, or any user interaction. Oracle characterizes the vulnerability as easily exploitable, meaning attack complexity is low and a working request pattern is straightforward to construct.

EPSS data assigns an exploit probability of 0.377% at the 30.99 percentile as of 2026-08-23. No public proof-of-concept, exploit database entry, or CISA KEV listing exists at time of publication.

Root Cause

The root cause is improper access control in the Security Component. The application fails to enforce authorization checks on requests that expose sensitive inventory data. Any endpoint reachable over HTTP that returns application data is susceptible when the caller supplies no credentials.

Attack Vector

The attack vector is network-based over HTTP. An attacker sends crafted HTTP requests directly to an exposed Oracle Communications Unified Inventory Management instance. Because the Security Component does not gate the requested resources, the application returns data the caller should not be permitted to view.

The vulnerability manifests in request handling within the Security Component. See the Oracle Security Alert Advisory for vendor-supplied technical details.

Detection Methods for CVE-2026-71142

Indicators of Compromise

Unauthenticated HTTP requests to Oracle Communications Unified Inventory Management endpoints returning HTTP 200 responses with data payloads
Anomalous volumes of outbound data from Unified Inventory Management hosts to untrusted source IPs
HTTP access logs showing requests to inventory or security component paths without prior authentication events
Requests originating from IP addresses outside expected operations, provisioning, or integration ranges

Detection Strategies

Review web server and application logs for HTTP requests that return sensitive inventory data without a preceding authenticated session
Deploy web application firewall rules that flag or block unauthenticated requests to Unified Inventory Management resource paths
Correlate network flow data against expected client inventories to surface unexpected external callers
Baseline normal API traffic volume and alert on statistically significant deviations to Unified Inventory Management endpoints

Monitoring Recommendations

Enable verbose HTTP request logging on Unified Inventory Management application servers and forward logs to a central SIEM
Monitor authentication service logs for absence of session tokens on data-returning requests
Track response sizes for Unified Inventory Management endpoints to detect bulk data extraction
Alert on any successful HTTP responses from Unified Inventory Management to source IPs not on an allowlist

How to Mitigate CVE-2026-71142

Immediate Actions Required

Apply the fixes referenced in the Oracle Security Alert Advisory (cspuaug2026) for all instances running affected versions
Inventory all Oracle Communications Unified Inventory Management deployments and confirm exposed versions against 7.5.0-7.5.1, 7.6.0-7.8.0, and 8.0.1
Restrict HTTP access to Unified Inventory Management to trusted management and integration networks only
Audit HTTP access logs for the period preceding patch deployment to identify potential unauthorized data access

Patch Information

Oracle addressed CVE-2026-71142 in the August 2026 Critical Security Patch Update. Administrators should consult the Oracle Security Alert Advisory (cspuaug2026) for the specific patch bundles that apply to each affected version and follow Oracle's documented upgrade procedure.

Workarounds

Place Unified Inventory Management behind a reverse proxy or web application firewall that enforces authentication before requests reach the application
Remove the application from any internet-facing network segment until patches are applied
Apply network access control lists that restrict HTTP access to known client subnets
Enforce mutual TLS or IP allowlisting on integration endpoints as a compensating control

bash

# Configuration example: restrict HTTP access with iptables
iptables -A INPUT -p tcp --dport 80 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP