This vulnerability exists in the Centralized Thirdparty Jars component of Oracle Platform Security for Java within Oracle Fusion Middleware. It is easily exploitable over the network by an attacker with low privileges and no user interaction is required. Successful exploitation can lead to complete compromise of Oracle Platform Security for Java, with high impact on confidentiality, integrity, and availability. The vulnerability also has a scope change, meaning it may affect additional Oracle products beyond the initially targeted component. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) confirms network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impacts across all security properties. Oracle’s July 2026 Critical Patch Update advisory references this vulnerability but does not provide explicit patch or mitigation instructions for it individually, instead bundling it among many fixes.

An attacker with network access and low privileges can exploit this vulnerability to take over Oracle Platform Security for Java, potentially compromising confidentiality, integrity, and availability of the affected system. Due to scope change, other Oracle products relying on this component may also be impacted. The critical CVSS score of 9.9 reflects the severe risk posed by this vulnerability.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. Although no explicit patch link or remediation instructions are provided for this specific vulnerability, Oracle strongly recommends applying the July 2026 Critical Patch Update promptly to address this and other vulnerabilities. Customers should remain on actively supported versions and apply all relevant security patches without delay. Patch status is not yet confirmed explicitly for this vulnerability alone; check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions.