The vulnerability lies in Oracle’s Platform Security for Java, specifically within the Centralized Thirdparty Jars component. An unauthenticated attacker who can reach the system via an HTTP interface can exploit the misconfiguration, resulting in a complete takeover of the Platform Security for Java product. Successful exploitation would compromise confidentiality, integrity, and availability, as indicated by an 8.1 CVSS score. The weakness stems from improper access controls that allow unauthorized usage of critical functionality.

The affected product is Oracle Platform Security for Java, version 12.2.1.4.0 and 14.1.2.0.0. These are part of Oracle Fusion Middleware, and no other versions are listed as impacted. Organizations should verify if one of these versions is in use.

With an 8.1 CVSS base score, the vulnerability is considered high severity. Although the EPSS is less than 1%, suggesting a low immediate exploitation probability, the lack of authentication in the attack vector means that any exposed HTTP endpoints can be tested by attackers. The vulnerability is not listed in CISA’s KEV catalog at this time, but the potential for full compromise warrants prompt action. The likely attack path requires network connectivity to the affected service and does not require any privileged credentials.