This vulnerability affects Oracle Platform Security for Java, a component of Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It is an easily exploitable flaw that allows an unauthenticated attacker with network access via HTTP to take over the Oracle Platform Security for Java component. The vulnerability's scope extends beyond this component, potentially affecting other Oracle products that rely on it. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and complete impact on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes targeted patches for this and many other vulnerabilities.

Successful exploitation results in complete compromise of Oracle Platform Security for Java, including full confidentiality, integrity, and availability impacts. Because this component is foundational, the vulnerability may also significantly impact additional Oracle products that depend on it, potentially leading to broader system compromise.

Oracle has released patches for this vulnerability in the September 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.