Vulnerability in Oracle Platform Security for Java, specifically the Centralized Thirdparty Jars component of Oracle Fusion Middleware. The affected releases are 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can exploit a misconfiguration that is difficult to exploit, allowing full takeover of the Platform Security for Java product. Successful exploitation would compromise confidentiality, integrity, and availability, as reflected in an 8.1 CVSS score.

The affected product is Oracle Platform Security for Java, version 12.2.1.4.0 and 14.1.2.0.0. These are part of Oracle Fusion Middleware, and no other versions are listed as impacted. Organizations should verify if one of these versions is in use.

With an 8.1 CVSS base score, the vulnerability is considered high severity. Although the EPSS is less than 1%, suggesting a low immediate exploitation probability, the lack of authentication in the attack vector means that any exposed HTTP endpoints can be tested by attackers. The vulnerability is not listed in CISA’s KEV catalog at this time, but the potential for full compromise warrants prompt action. The likely attack path requires network connectivity to the affected service and does not require any privileged credentials.