This vulnerability exists in the Centralized Thirdparty Jars component of Oracle Platform Security for Java. It is exploitable remotely without authentication but is considered difficult to exploit due to the required conditions. Successful exploitation can lead to full compromise of the Oracle Platform Security for Java component. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Affected versions explicitly include 12.2.1.4.0 and 14.1.2.0.0. Oracle has included this fix in its September 2026 Critical Security Patch Update, which contains numerous security patches across many products including Oracle Platform Security for Java.

If exploited, this vulnerability allows an unauthenticated attacker to take over the Oracle Platform Security for Java component, potentially leading to full compromise of the affected system's security functionality. The impact affects confidentiality, integrity, and availability, indicating that sensitive data could be exposed or altered and system operations disrupted.

Oracle has released a security patch for this vulnerability as part of the September 2026 Critical Security Patch Update. Users of affected versions 12.2.1.4.0 and 14.1.2.0.0 should apply the available patches promptly. Oracle strongly recommends staying on actively supported versions and applying security patches without delay. No vendor advisory states that no action is required or that the issue is already mitigated without patching.