This vulnerability exists in the Centralized Thirdparty Jars component of Oracle Platform Security for Java within Oracle Fusion Middleware. It is easily exploitable remotely without authentication via HTTP, enabling attackers to compromise and take over the Oracle Platform Security for Java component. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. Affected versions explicitly include 12.2.1.4.0 and 14.1.2.0.0. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not provide explicit patch details for these versions in the supplied content.

Successful exploitation can lead to complete compromise of Oracle Platform Security for Java, impacting confidentiality, integrity, and availability of the affected system. This could allow attackers to take over the security platform, potentially undermining security controls dependent on it.

Oracle has published a Critical Patch Update advisory for July 2026 that addresses multiple vulnerabilities including this one. However, the provided advisory content does not explicitly confirm patch availability or remediation status for the affected versions 12.2.1.4.0 and 14.1.2.0.0 of Oracle Platform Security for Java. Users should consult the official Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply relevant patches promptly. Until official patches are confirmed and applied, no specific workaround or temporary fix is documented in the provided data.