The Oracle HTTP Server is vulnerable due to a weakness in the WebLogic Server Proxy Plug‑in component that lets an unauthenticated attacker perform unauthorized creation, deletion, or modification of data exposed through the server. Based on the description, it is inferred that the lack of proper authentication checks is the cause, and this issue is categorized as CWE‑200. Successful exploitation can result in unauthorized access to critical data or complete tampering of all server‑accessible information, affecting confidentiality and integrity without direct availability damage.

Affected systems include Oracle HTTP Server versions 12.2.1.4.0 and 14.1.2.0.0, which are part of Oracle Fusion Middleware. Installations that incorporate the WebLogic Server Proxy Plug‑in for Oracle HTTP Server are at risk. The advisory notes that attacks may also affect other Oracle products due to a scope change.

The CVSS 3.1 base score of 8.7 highlights high severity, with an attack vector over the network via HTTP, no authentication required, high attack complexity, and no user interaction. The EPSS score is less than 1%, indicating a very low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers could leverage the plug‑in weakness to execute unauthorized actions and potentially reach other affected Oracle products because the scope has changed. Until a patch is applied, the risk remains significant.