CVE-2026-83342

A high-severity vulnerability (CVSS 3.1 base score 7.8) in the System Wide component of Oracle Utilities Network Management System (OUNMS) allows a low-privileged attacker who already has logon access to the host where OUNMS executes to escalate privileges and take over the entire product. The flaw is described by Oracle as easily exploitable via the local attack vector with no user interaction required, and successful attacks compromise confidentiality, integrity, and availability of the NMS. All supported release lines are affected, spanning versions 2.4.0.1.x through 2.6.0.2.x and the 25.12.0.0.x line. Because exploitation requires pre-existing local access to the NMS infrastructure, the realistic threat is from malicious or compromised insiders, lateral movement after an initial host compromise, or misuse by over-privileged service accounts rather than remote internet-based attackers. No public proof of concept exists, the CVE is not in the CISA Known Exploited Vulnerabilities catalog, and no exploitation in the wild is known at this time.

What to do: Apply the Oracle Critical Patch Update remediation for this CVE on every affected OUNMS instance and verify that no servers remain on the listed affected version ranges. Since the attack requires local logon to the NMS host, restrict OS-level accounts on those servers to the minimum necessary, enforce least privilege for service accounts, and audit local authentication and privilege-escalation events. If unauthorized local account activity is suspected, rotate credentials on the NMS hosts and review for follow-on compromise of the system.