This vulnerability affects Oracle Platform Security for Java, a component of Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable by an attacker with low privileges and network access via HTTP. Successful exploitation can result in full compromise of the Oracle Platform Security for Java component. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle has published this vulnerability as part of its July 2026 Critical Patch Update, which addresses 1449 security issues across various products. However, the vendor advisory does not explicitly confirm the availability of a patch specifically for this vulnerability within the advisory text provided.

The vulnerability allows an attacker with low privileges and network access via HTTP to fully compromise Oracle Platform Security for Java. This can lead to complete takeover of the affected component, impacting confidentiality, integrity, and availability of the system. The CVSS score of 8.8 reflects a high impact severity.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. Customers are strongly advised to apply the relevant patches from this update promptly. The vendor advisory emphasizes the importance of applying available Oracle patches without delay to prevent exploitation. Patch status for this specific vulnerability is not explicitly confirmed in the advisory content provided; therefore, users should consult the official Oracle Critical Patch Update documentation at https://www.oracle.com/security-alerts/cpujul2026.html for detailed patch availability and installation instructions.