This vulnerability affects Oracle Platform Security for Java, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It is an easily exploitable flaw that requires no authentication and can be triggered remotely over HTTP. The impact includes full compromise of the product, affecting confidentiality, integrity, and availability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms network attack vector with low complexity and no privileges or user interaction required. Oracle's July 2026 Critical Patch Update advisory includes patches addressing this vulnerability among 1449 others. The vendor strongly recommends applying these patches without delay to prevent exploitation.

An unauthenticated attacker with network access via HTTP can exploit this vulnerability to take over Oracle Platform Security for Java. This results in complete compromise of confidentiality, integrity, and availability of the affected product. Such a compromise could allow attackers to control the security platform, potentially impacting dependent systems and applications.

Oracle has released patches for this vulnerability as part of the July 2026 Critical Patch Update. Users of Oracle Platform Security for Java versions 12.2.1.4.0 and 14.1.2.0.0 should apply the relevant patches immediately. Oracle strongly recommends remaining on actively-supported versions and applying security patches without delay. Patch status is confirmed by the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html.