This vulnerability affects Oracle HTTP Server components of Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It allows an unauthenticated attacker with network access over HTTP to compromise the server, potentially resulting in unauthorized creation, deletion, or modification of critical data. The vulnerability has a CVSS 3.1 score of 8.7, indicating high severity with significant confidentiality and integrity impacts. The vulnerability also has a scope change, meaning it can affect additional Oracle products beyond the HTTP Server itself. Oracle has addressed this vulnerability in its April 2026 Critical Patch Update, which includes patches for Fusion Middleware products. The vendor strongly recommends applying these patches without delay. There are no reports of known exploits in the wild.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data accessible via Oracle HTTP Server, as well as unauthorized access to such data. The vulnerability affects confidentiality and integrity but does not impact availability. The scope of impact extends beyond Oracle HTTP Server to other Oracle products that rely on it. The CVSS score of 8.7 reflects a high severity level.

Oracle has released patches for this vulnerability as part of the April 2026 Critical Patch Update for Fusion Middleware products. Customers should promptly apply the relevant patches to affected Oracle HTTP Server versions (12.2.1.4.0 and 14.1.2.0.0) to remediate this vulnerability. Oracle strongly advises remaining on actively-supported versions and applying Critical Patch Updates without delay. Patch status is confirmed by the vendor advisory. No additional mitigation steps are specified beyond applying the official patches.