This vulnerability affects Oracle Security Service version 12.2.1.4.0 within Oracle Fusion Middleware's Oracle SSL API component. It allows a low privileged attacker with network access over TLS to compromise the service, but exploitation is difficult and requires user interaction from a third party. The impact includes unauthorized creation, deletion, or modification of critical data or full access to all data accessible by the Oracle Security Service. The CVSS 3.1 vector is AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N, reflecting network attack vector, high attack complexity, low privileges required, required user interaction, unchanged scope, and high confidentiality and integrity impact without availability impact. No official patch or remediation level is confirmed in the advisory, and no known exploits are reported in the wild. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability for this specific version.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or complete unauthorized access to all data accessible by Oracle Security Service 12.2.1.4.0. This compromises confidentiality and integrity of the data but does not affect availability. The attack requires network access via TLS and user interaction from a person other than the attacker, making exploitation difficult.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory (https://www.oracle.com/security-alerts/cpujul2026.html) for current remediation guidance. Oracle strongly recommends applying security patches without delay and remaining on actively supported versions. Since no explicit patch or temporary fix is stated for this vulnerability, monitoring Oracle advisories for updates is advised. No vendor advisory states that no action is required or that the issue is already mitigated.