This vulnerability affects Oracle Fusion Middleware Control (component: Framework) in versions 12.2.1.4.0 and 14.1.2.0.0. It is exploitable remotely over the network via HTTP by a low privileged attacker but requires user interaction from a person other than the attacker. The scope of impact extends beyond Fusion Middleware Control to additional Oracle products. Exploitation can result in unauthorized modification (update, insert, delete) and unauthorized read access to some accessible data within Oracle Fusion Middleware Control. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, reflecting network attack vector, low attack complexity, low privileges required, user interaction required, scope change, and partial confidentiality and integrity impact without availability impact. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update.

Successful exploitation can lead to unauthorized update, insertion, or deletion of some accessible data in Oracle Fusion Middleware Control, as well as unauthorized read access to a subset of data. The vulnerability affects confidentiality and integrity but does not impact availability. The scope change indicates that other Oracle products relying on Fusion Middleware Control may also be affected.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Users should apply the relevant patches promptly to affected versions 12.2.1.4.0 and 14.1.2.0.0. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or 'no action required' statements are provided by Oracle.