This vulnerability exists in the Centralized Thirdparty Jars component of Oracle Platform Security for Java within Oracle Fusion Middleware. It requires an attacker to have physical access to the communication segment attached to the hardware where the software executes, making exploitation difficult. The vulnerability allows compromise and takeover of Oracle Platform Security for Java, with potential cascading effects on other Oracle products. The CVSS vector indicates attack vector as adjacent network, high attack complexity, low privileges required, no user interaction, and scope change with high confidentiality, integrity, and availability impacts. Oracle's July 2026 Critical Patch Update advisory mentions many patches but does not explicitly confirm a fix for this vulnerability, and no patch links are provided in the source data.

Successful exploitation results in complete compromise of Oracle Platform Security for Java, affecting confidentiality, integrity, and availability of the component. Due to scope change, other Oracle products relying on this component may also be significantly impacted. The vulnerability requires physical access to the communication segment, limiting the attack surface but still posing a serious risk in environments where such access is possible.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict physical access to the communication segments attached to the hardware running Oracle Platform Security for Java to reduce risk.