The vulnerability resides in the framework component of Oracle Fusion Middleware Control and permits an attacker with physical access to the host machine to take control of the control interface. The flaw allows privileged local operations without adequate authentication, enabling the attacker to modify, delete, or otherwise tamper with middleware configurations, which in turn can compromise confidentiality, integrity and availability of the managed WebLogic servers and related services.

Oracle Fusion Middleware Control versions 12.2.1.4.0 and 14.1.2.0.0 are affected. These are typically deployed in enterprise environments where the control component orchestrates WebLogic Server instances and other Oracle middleware stacks.

The CVSS 3.1 base score of 6.6 indicates moderate severity. Attackers must have physical presence on the server and a colliding user to provide input (this requirement is inferred from the description), which limits the likelihood of widespread exploitation. Although the EPSS score is very low at < 1% and the vulnerability is not listed in the CISA KEV catalog, it remains a high‑impact local privilege escalation scenario that can lead to complete takeover of the control plane if exploited.