Vulnerability in the Dynamic Monitoring Service of Oracle Fusion Middleware allows a low‑privileged attacker with network access to HTTP to obtain unauthorized read, insert, update, or delete access to data that the middleware exposes when the attacker can reach a user other than themselves. The weakness stems from insufficient access control and privilege checks, enabling the attacker to bypass expected restrictions. This can lead to confidentiality and integrity issues on sensitive data managed by the middleware.

Oracle Corporation’s Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 are affected. These versions include the Dynamic Monitoring Service component that the flaw exploits.

The CVSS score of 5.4 indicates a moderate severity. The attack vector is network‑based over HTTP, with low effort and local privileges, but it still requires the attacker to interact with an additional human user. The EPSS score is not available, so the likelihood of exploitation cannot be quantified, and the vulnerability is not listed in the CISA KEV catalogue. Nevertheless, because successful exploitation can change, delete, or read data, the potential impact on confidentiality and integrity warrants swift action. In addition, the vulnerability’s scope change means attackers could affect other Oracle products beyond Fusion Middleware.