This vulnerability in Oracle Fusion Middleware's Service Delivery Platform Messaging Enabler allows a low privileged attacker with infrastructure logon to compromise the platform. The attack scope includes unauthorized creation, deletion, or modification of critical data, affecting confidentiality and integrity with no impact on availability. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) indicates local attack vector, low attack complexity, low privileges required, no user interaction, scope changed, and high confidentiality and integrity impacts. The affected versions are 12.2.1.4.0 and 14.1.2.0.0. Oracle's July 2026 Critical Patch Update advisory mentions this vulnerability but does not explicitly confirm patch availability or remediation status in the provided content.

Exploitation can result in unauthorized creation, deletion, or modification of critical data within the Service Delivery Platform, leading to a complete compromise of confidentiality and integrity of all accessible data. The vulnerability may also impact additional Oracle products due to scope change. There is no reported impact on availability. No known exploits in the wild have been reported at this time.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the provided advisory content does not explicitly confirm the availability of a patch or official remediation for this specific vulnerability. Customers are strongly advised to review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Until a patch is confirmed and applied, restrict infrastructure logon access to trusted users only to reduce risk.