This vulnerability in Oracle HTTP Server (mod_ssl component) allows unauthenticated remote attackers to exploit the server via HTTP network access. Successful exploitation can result in unauthorized creation, deletion, or modification of critical or all accessible data on the Oracle HTTP Server. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects that the attack requires no privileges or user interaction and can be performed remotely with low complexity, causing high confidentiality and integrity impact but no availability impact. Affected versions explicitly include 12.2.1.4.0 and 14.1.2.0.0. The vendor advisory from Oracle (July 2026 Critical Patch Update) references this vulnerability but does not explicitly confirm patch availability or remediation status for these versions.

An attacker can remotely exploit this vulnerability without authentication to gain unauthorized access to Oracle HTTP Server data, including the ability to create, delete, or modify critical data. This compromises confidentiality and integrity of the server data but does not affect availability. The vulnerability poses a critical risk to affected Oracle HTTP Server deployments.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory (https://www.oracle.com/security-alerts/cpujul2026.html) for current remediation guidance. Oracle strongly recommends applying security patches promptly on actively supported versions. Until a patch is confirmed and applied, restrict network access to Oracle HTTP Server where possible to reduce exposure.