This vulnerability allows an attacker who already has a low‑privilege account on the host running Oracle Middleware Common Libraries and Tools to exploit the Remote Diagnostic Agent component and obtain unauthorized access to critical data stored by the product. The flaw is identified as information disclosure (CWE‑200), resulting in confidentiality impact only, with no known impact on integrity or availability.

Oracle Corporation’s Oracle Middleware Common Libraries and Tools are affected across versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. These versions are listed in the Oracle CPUs for October 2026 and include the Remote Diagnostic Agent component.

The CVSS 3.1 base score of 5.5 indicates a moderate severity vulnerability that can be exploited by local users. EPSS is < 1%, indicating a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited current exploitation activity. The likely attack vector is local, requiring an attacker to have logged onto the infrastructure where the product runs. Once exploited, an attacker can read protected data exposed by the Remote Diagnostic Agent. No remote exploitation path is documented in the description, so the risk is confined to environments where local accounts can access the host.