This vulnerability affects Oracle Platform Security for Java, part of Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It requires an attacker to have low privileges and physical access to the communication segment attached to the hardware where the software executes. Exploitation can result in complete compromise of Oracle Platform Security for Java, with potential scope change affecting other Oracle products. The CVSS 3.1 vector is AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, reflecting attack complexity and required access conditions. Oracle has published a Critical Patch Update advisory in July 2026 covering multiple vulnerabilities, including this one, but no explicit patch or remediation level for this specific vulnerability is stated in the advisory content provided.

Successful exploitation allows an attacker with low privileges and physical access to the hardware communication segment to take over Oracle Platform Security for Java. This can lead to full compromise of the component, impacting confidentiality, integrity, and availability of the affected system. Additionally, due to scope change, other Oracle products relying on this component may also be significantly affected.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict physical access to hardware communication segments running Oracle Platform Security for Java to mitigate exploitation risk.