The vulnerability discovered in the Oracle HTTP Server and the Weblogic Server Proxy Plug‑in allows an unauthenticated attacker who can reach the server via HTTP to create, delete, or modify critical data, and to access all information exposed by the server. It effectively undermines both confidentiality and integrity, permitting a privileged level of access to sensitive information and the potential to tamper with the system’s data. The flaw resides in an authorization control weakness that permits these actions without requiring valid credentials.

Oracle HTTP Server versions 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0, as well as the Weblogic Server Proxy Plug‑in for Apache HTTP Server and for IIS. The IIS plug‑in is affected only in version 12.2.1.4.0, while the Apache plug‑in versions 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 are all vulnerable.

The CVSS base score of 10.0 indicates a critical risk level, with the vector describing a local access complexity that is low, no privilege or user interaction required, and a change of scope that expands the impact from the individual component to the broader Oracle Fusion Middleware environment. The current EPSS score is reported as less than 1%, suggesting that exploitation is unlikely at present, but the vulnerability is not listed in the CISA KEV catalog. Nonetheless, because the flaw can be leveraged from any machine that can reach the HTTP interface, the potential for a disruptive data breach remains high, and the lack of authentication requirements makes the attack path straightforward.