A flaw in the OSSL Module of Oracle HTTP Server allows an attacker who has low privileges and network access via HTTP to create, delete, or modify data that the server hosts. The vulnerability compromises confidentiality and integrity by letting the attacker read or alter critical data without proper authorization. The flaw is remotely exploitable and can lead to unauthorized access to all data exposed by the HTTP Server.

Oracle HTTP Server versions 12.2.1.4.0 and 14.1.2.0.0 are affected. The vulnerability resides within the Oracle Fusion Middleware OSSL Module and may influence additional Oracle products because the attack can change the overall scope.

The CVSS score of 9.6 indicates high severity, with low attack complexity and low required privileges. The attack vector is network‑based via HTTP, and there is no user interaction needed. The EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog. Successful exploitation can provide the attacker with unauthorized creation, deletion, or modification of data and read access to all Oracle HTTP Server accessible data, while potentially extending the impact to additional Oracle products due to a scope change. No privilege escalation beyond the attacker’s existing low privileges is required.