This vulnerability exists in the Centralized Thirdparty Jars component of Oracle Platform Security for Java within Oracle Fusion Middleware. It is easily exploitable remotely without authentication via HTTP, enabling an attacker to compromise the product completely. The vulnerability has a CVSS 3.1 base score of 10.0, indicating critical impact on confidentiality, integrity, and availability. While the vulnerability is localized to Oracle Platform Security for Java, successful exploitation may affect additional Oracle products due to scope change. The vendor advisory references a July 2026 Critical Patch Update containing numerous patches but does not explicitly confirm a patch for this vulnerability.

Successful exploitation results in complete takeover of Oracle Platform Security for Java, impacting confidentiality, integrity, and availability. Due to scope change, other Oracle products relying on this component may also be significantly affected. The vulnerability is remotely exploitable without authentication, increasing risk.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying Critical Patch Updates promptly. Until a specific patch is confirmed, monitor Oracle advisories for updates and apply patches as soon as they become available.