CVE-2026-83343

CVE-2026-83343 is a vulnerability in the System Wide component of Oracle Utilities Network Management System (OUNMS), part of Oracle Utilities Applications, rated High with a CVSS 3.1 base score of 8.2. An unauthenticated attacker with network access via HTTP can exploit the flaw easily and without user interaction, gaining unauthorized read access to critical data or all OUNMS-accessible data, as well as unauthorized update, insert, and delete access to some of that data (confidentiality high, integrity low, no availability impact). The affected deployments are utility organizations running OUNMS versions 2.5.0.2.0-2.5.0.2.13, 2.6.0.1.0-2.6.0.12B, 2.6.0.2.0-2.6.0.2.10A, or 25.12.0.0.0-25.12.0.0.3. Because OUNMS is typically deployed inside utility operations networks and is not broadly internet-exposed, the attack surface is concentrated but high-value (grid/outage and customer operational data). No public proof-of-concept exists, the flaw is not on the CISA KEV list, and no exploitation in the wild is known as of this analysis.

What to do: Apply Oracle's Critical Patch Update remediation for CVE-2026-83343 to all OUNMS instances on versions 2.5.0.2.x, 2.6.0.1.x/2.6.0.2.x, and 25.12.0.0.x as soon as the fix is available. Restrict HTTP access to OUNMS endpoints to trusted internal networks, management VPNs, or allowlisted IPs, since the flaw requires no authentication and is rated easily exploitable. Review logs for anomalous unauthenticated data reads or unexpected update/insert/delete activity against OUNMS data going back to patch deployment.