This vulnerability affects Oracle Security Service in Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 12.1.3.0.0. It is a network exploitable vulnerability requiring low privileges and user interaction from a third party, allowing attackers to compromise the service via HTTPS. The impact includes unauthorized creation, deletion, or modification of critical data and unauthorized access to all data accessible by Oracle Security Service. The CVSS vector indicates network attack vector, high attack complexity, low privileges required, user interaction required, unchanged scope, and high confidentiality and integrity impacts. Oracle has released patches for this vulnerability as part of the April 2026 Critical Patch Update, which includes 481 security fixes across multiple products. Customers are urged to apply these patches without delay to prevent exploitation.

If exploited, this vulnerability can lead to unauthorized creation, deletion, or modification of critical data within Oracle Security Service, as well as unauthorized access to all data accessible by the service. This compromises confidentiality and integrity of the affected data. However, exploitation is difficult, requires network access via HTTPS, low privileges, and user interaction from a third party. There is no impact on availability. No known exploits in the wild have been reported.

Oracle has released security patches addressing this vulnerability in the April 2026 Critical Patch Update for Fusion Middleware products, including Oracle Security Service. Customers should apply these official patches promptly to remediate the vulnerability. Oracle strongly recommends remaining on actively supported versions and applying Critical Patch Updates without delay. Patch status is confirmed as official fix available via Oracle's advisory at https://www.oracle.com/security-alerts/cpuapr2026.html.