The Oracle Global Lifecycle Management NextGen OUI Framework suffers from an unauthenticated HTTP-based denial‑of‑service vulnerability in its NextGen Installer component. An attacker with network access can send crafted requests that cause the framework to hang or crash repeatedly, resulting in a complete service interruption. The flaw is classified under weaknesses that allow resource exhaustion or memory corruption (CWE-400) and has a CVSS 3.1 base score of 7.5, indicating a high severity and an impact limited to availability.

Oracle Global Lifecycle Management NextGen OUI Framework versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 14.1.2.1.0 and 15.1.1.0.0 are affected. Systems running these releases, often part of Oracle Fusion Middleware environments, are vulnerable if exposed to external HTTP traffic.

The EPSS score of <1% reflects a low but nonzero probability of exploitation. The vulnerability is easily exploitable with low complexity and no authentication required. Because it permits full denial of service, the attack poses a significant risk to uptime for organizations that rely on continuous operation of the framework. No active exploitation has been reported in the CISA KEV catalog, but the high availability impact warrants prompt action.