The vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework arises in its NextGen Installer component. An unauthenticated attacker with network access through HTTP can induce an application hang or a repeatable crash, leading to a complete denial of service. The CVSS 3.1 base score of 7.5 signifies high severity and indicates that the impact is limited to availability, with no direct compromise of confidentiality or integrity.

The affected product is Oracle Global Lifecycle Management NextGen OUI Framework, part of Oracle Fusion Middleware. Supported releases that are vulnerable include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 14.1.2.1.0 and 15.1.1.0.0. All instances running these versions could be exposed to the described denial‑of‑service attack vector.

The CVSS score reflects a high level of risk, and the EPSS score is not publicly available, but the description emphasizes that the flaw is easily exploitable. The attack vector is network‑based over HTTP and does not require authentication, making it accessible to any remote actor. The lack of a listed KEV designation suggests that no active exploits are currently documented; however, the low attack complexity and high availability impact raise concerns for organizations that rely on continuous uptime of the framework.