A vulnerability exists in the OSSL Module of Oracle HTTP Server that allows a low‑privileged attacker who has logged onto the same infrastructure as the server to compromise the application and take control. The impact is complete loss of confidentiality, integrity, and availability for the affected server. The CVSS 3.1 base score of 7.8 reflects local attack, low authentication, and no user interaction requirements, indicating the issue can be exploited with minimal effort once the attacker has local access.

Oracle Corporation’s Oracle HTTP Server, version 12.2.1.4.0, is the sole affected product. No other releases or variants are listed as vulnerable.

The risk is significant for environments where the server is accessible to users with low privileges, because the attack vector is local (AV:L) and does not require network exposure. The EPSS score is not available, but the absence of a CISA KEV listing suggests the vulnerability has not yet been widely exploited. An attacker who gains a logon to the host can exploit the OSSL Module flaw to obtain full control of the HTTP Server, potentially extending further attacks within the infrastructure.