Description
Vulnerability in the Oracle Security Service product of Oracle Fusion Middleware (component: C Oracle SSL API). Supported versions that are affected are 12.2.1.4.0 and 12.1.3.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Security Service. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Security Service accessible data as well as unauthorized access to critical data or complete access to all Oracle Security Service accessible data. CVSS 3.1 Base Score 6.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N).
Published: 2026-04-21
Score: 6.4 Medium
EPSS: n/a
KEV: No
Impact: Data Integrity and Confidentiality Breach
Action: Patch Now
AI Analysis

Impact

A vulnerability in the Oracle Security Service product of Oracle Fusion Middleware allows a low‑privileged attacker with HTTPS network access to compromise the service. The flaw can result in unauthorized creation, deletion or modification of critical data and can grant unauthorized access to all data accessible through the Oracle Security Service. The weakness is related to improper access control and can affect confidentiality and integrity of the system.

Affected Systems

Oracle Corporation Oracle Security Service 12.1.3.0.0 and 12.2.1.4.0 are affected.

Risk and Exploitability

The CVSS 3.1 base score of 6.4 indicates a moderate severity with high impact on confidentiality and integrity, while the standard attack vector is network based (HTTPS). The vulnerability has a high attack complexity and low privileges, and requires user interaction, which makes exploitation difficult but still possible. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog.

Generated by OpenCVE AI on April 22, 2026 at 06:26 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Oracle patch or upgrade the Oracle Security Service to a version later than 12.2.1.4.0.
  • Restrict HTTPS access to the Oracle Security Service to trusted hosts and implement network segmentation to limit potential attack surface.
  • Re‑evaluate and enforce strict role‑based access controls to prevent unauthorized data modification or access, ensuring that only authorized users have the necessary permissions.

Generated by OpenCVE AI on April 22, 2026 at 06:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 22 Apr 2026 06:45:00 +0000

Type Values Removed Values Added
Title Low‑Privilege HTTPS Vulnerability in Oracle Security Service Enables Unauthorized Data Modification
Weaknesses CWE-284

Wed, 22 Apr 2026 00:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Security Service product of Oracle Fusion Middleware (component: C Oracle SSL API). Supported versions that are affected are 12.2.1.4.0 and 12.1.3.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Security Service. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Security Service accessible data as well as unauthorized access to critical data or complete access to all Oracle Security Service accessible data. CVSS 3.1 Base Score 6.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle security Service
CPEs cpe:2.3:a:oracle:security_service:12.1.3.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:security_service:12.2.1.4.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle security Service
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle Security Service
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-04-21T20:35:54.676Z

Reserved: 2026-04-01T20:03:40.834Z

Link: CVE-2026-35252

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-04-21T21:16:41.560

Modified: 2026-04-21T21:16:41.560

Link: CVE-2026-35252

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-22T06:30:10Z

Weaknesses