This vulnerability exists in the Centralized Thirdparty Jars component of Oracle Platform Security for Java within Oracle Fusion Middleware. It allows an attacker with low privileges and logon access to the affected infrastructure to compromise the Oracle Platform Security for Java component. Successful exploitation can result in complete takeover of the component, impacting confidentiality, integrity, and availability. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects that the attack requires local access with low complexity and privileges but no user interaction. The vulnerability affects versions 12.2.1.4.0 and 14.1.2.0.0. Oracle has included fixes for this vulnerability in its September 2026 Critical Security Patch Update, which contains numerous patches across many products including Oracle Platform Security for Java. The vendor strongly recommends applying these patches without delay.

The vulnerability allows a low privileged attacker with logon access to the affected infrastructure to fully compromise Oracle Platform Security for Java. This can lead to complete takeover of the component, resulting in high impact on confidentiality, integrity, and availability of the system. Such compromise could undermine the security of Oracle Fusion Middleware environments relying on this component.

Oracle has released security patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply the relevant patches for Oracle Platform Security for Java versions 12.2.1.4.0 and 14.1.2.0.0 promptly. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to prevent exploitation. No alternative mitigations or workarounds are indicated in the vendor advisory.