This vulnerability exists in the Oracle Platform Security for Java component of Oracle Fusion Middleware, specifically in Centralized Thirdparty Jars. It permits a low privileged attacker with network access via HTTP to compromise the system, leading to a complete takeover of Oracle Platform Security for Java. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The affected versions explicitly identified are 12.2.1.4.0 and 14.1.2.0.0. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among 1449 patches but does not explicitly state the patch availability or remediation status for this specific CVE in the provided content.

Successful exploitation can lead to full compromise of Oracle Platform Security for Java, impacting confidentiality, integrity, and availability of the affected system. This could allow attackers to take over the platform security component, potentially undermining the security of dependent applications and services.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. Customers are strongly advised to review the advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply the relevant patches promptly. Patch status for this specific vulnerability is not explicitly confirmed in the advisory excerpt provided; therefore, users should verify patch availability and installation instructions from the official Oracle advisory. No vendor statement indicates that no action is required or that the issue is already mitigated.