This vulnerability affects Oracle Platform Security for Java, a component of Oracle Fusion Middleware. It is easily exploitable by an attacker with low privileges who has network access via HTTP. Successful exploitation can lead to complete compromise of the Oracle Platform Security for Java component. The CVSS 3.1 vector indicates network attack vector (AV:N), low attack complexity (AC:L), low privileges required (PR:L), no user interaction (UI:N), unchanged scope (S:U), and high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H). The affected versions explicitly identified are 12.2.1.4.0 and 14.1.2.0.0. The vendor advisory from Oracle (July 2026 Critical Patch Update) references this vulnerability but does not explicitly confirm patch availability or remediation status for these versions at this time.

The vulnerability allows an attacker with low privileges and network access via HTTP to fully compromise Oracle Platform Security for Java. This results in high impact on confidentiality, integrity, and availability of the affected component, potentially enabling takeover of the security platform.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly once available and remaining on actively supported versions. Until a patch is confirmed, restrict network access to Oracle Platform Security for Java components where possible.