CVE-2026-71143: Oracle Unified Inventory Management Bypass

CVE-2026-71143 Overview

CVE-2026-71143 is a high-severity vulnerability in the Oracle Communications Unified Inventory Management (UIM) product. The flaw resides in a third-party component and affects supported versions 7.5.0, 7.5.1, 7.6.0 through 7.8.0, and 8.0.1. An unauthenticated remote attacker with network access via HTTP can compromise the application. Successful exploitation grants unauthorized creation, deletion, or modification of critical data and complete read access to all UIM-accessible data. Oracle classifies the attack complexity as high, meaning exploitation requires specific conditions to succeed. The vulnerability is tracked under CWE-284: Improper Access Control.

Critical Impact
Unauthenticated network attackers can achieve full read and write access to all data stored within Oracle Communications Unified Inventory Management.

Affected Products

Oracle Communications Unified Inventory Management 7.5.0 and 7.5.1
Oracle Communications Unified Inventory Management 7.6.0 through 7.8.0
Oracle Communications Unified Inventory Management 8.0.1

Discovery Timeline

2026-08-18 - CVE-2026-71143 published to the National Vulnerability Database
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-71143

Vulnerability Analysis

CVE-2026-71143 is an improper access control weakness [CWE-284] within a third-party component embedded in Oracle Communications Unified Inventory Management. The vulnerability is reachable over HTTP without authentication or user interaction. Oracle's advisory scopes the impact to confidentiality and integrity, with no impact on availability. Successful exploitation allows an attacker to read, create, modify, or delete any data accessible to the UIM application. UIM stores telecommunications inventory data including network resources, services, and customer records, making unauthorized modification particularly consequential for service integrity.

Root Cause

The root cause is improper enforcement of access controls in a bundled third-party component. Access decisions are not correctly validated for HTTP requests reaching the affected endpoints. Oracle has not publicly identified the specific third-party library involved in the Oracle Security Alert.

Attack Vector

The attack vector is network-based via HTTP. An attacker does not require authentication or user interaction to reach the vulnerable code path. Attack complexity is rated high, indicating that specific timing, configuration, or environmental conditions must be present for reliable exploitation. No public proof-of-concept code, exploit database entry, or in-the-wild exploitation has been reported at the time of publication.

No verified exploitation code is publicly available. See the Oracle Security Alert for vendor-provided technical context.

Detection Methods for CVE-2026-71143

Indicators of Compromise

Unauthenticated HTTP requests to UIM application endpoints originating from unexpected external sources.
Unexplained creation, modification, or deletion of inventory records, network resource entries, or service configurations in UIM.
Anomalous read patterns against UIM data stores, especially bulk exports outside normal business processes.
Application logs showing successful data operations without a corresponding authenticated user session.

Detection Strategies

Review UIM web tier and application server access logs for HTTP requests to third-party component paths lacking authentication headers or session cookies.
Correlate database audit logs against authenticated UIM sessions to identify writes without an associated user context.
Deploy web application firewall (WAF) rules to alert on requests to UIM URIs that bypass the authentication redirect flow.

Monitoring Recommendations

Enable verbose HTTP access logging on WebLogic or the fronting reverse proxy for all UIM endpoints.
Forward UIM application, database, and web server logs to a centralized SIEM for correlation and retention.
Establish baselines for normal inventory record change volume and alert on deviations.

How to Mitigate CVE-2026-71143

Immediate Actions Required

Apply the fixes published in the Oracle Security Alert of August 2026 to all affected UIM instances.
Restrict network access to UIM HTTP interfaces to trusted management networks and known integration systems only.
Audit UIM data for unauthorized additions, deletions, or modifications since deployment of affected versions.
Rotate any credentials, API keys, or tokens stored in or accessible through UIM as a precaution.

Patch Information

Oracle released fixes for CVE-2026-71143 as part of the August 2026 Critical Patch Update cycle. Administrators should consult the Oracle Security Alert for the specific patch bundle applicable to their UIM version (7.5.0, 7.5.1, 7.6.0-7.8.0, or 8.0.1). Apply patches in a staged environment before promoting to production.

Workarounds

Place UIM HTTP endpoints behind an authenticating reverse proxy or WAF that enforces access control before requests reach the application.
Block direct internet exposure of UIM by allowlisting only required internal IP ranges at the network firewall.
Disable or isolate the affected third-party component if operationally feasible pending patch deployment.

bash

# Example: restrict UIM HTTP access at the network edge
# Allow only trusted management subnet
iptables -A INPUT -p tcp --dport 7001 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7001 -j DROP