This vulnerability exists in the Dynamic Monitoring Service component of Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0. It allows an attacker with low privileges and network access via HTTP to compromise the system by leveraging user interaction from a third party. Successful exploitation can lead to unauthorized update, insert, or delete operations, as well as unauthorized read access to some data accessible through Oracle Fusion Middleware. The vulnerability affects confidentiality and integrity but not availability, with a CVSS 3.1 score of 5.4. The scope of impact extends beyond Fusion Middleware to additional Oracle products. Oracle has addressed this vulnerability in its April 2026 Critical Patch Update.

Exploitation of this vulnerability can result in unauthorized modification (update, insert, delete) and unauthorized reading of certain data accessible via Oracle Fusion Middleware. The attacker requires network access and low privileges, and successful exploitation depends on user interaction by a third party. The vulnerability impacts confidentiality and integrity but does not affect availability. There are no reports of active exploitation in the wild. The scope of impact may extend to other Oracle products beyond Fusion Middleware.

Oracle has released patches for this vulnerability as part of the April 2026 Critical Patch Update for Fusion Middleware products. Customers are strongly advised to apply these patches without delay to mitigate the risk. Oracle emphasizes remaining on actively supported versions and promptly applying Critical Patch Updates. No alternative mitigations or workarounds are specified in the advisory. Patch status is confirmed by the vendor advisory.