EUVD-2026-24437
GHSA-3cff-g674-f8v5
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Network-accessible HTTP attack requiring a low-privileged account and victim interaction; scope change reflects DMS cross-cutting architecture; no availability impact described.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Vulnerability in Oracle Fusion Middleware (component: Dynamic Monitoring Service). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Fusion Middleware. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Fusion Middleware, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Fusion Middleware accessible data as well as unauthorized read access to a subset of Oracle Fusion Middleware accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
AnalysisAI
Improper access control in the Dynamic Monitoring Service (DMS) component of Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0 enables low-privileged authenticated attackers to perform unauthorized read and write operations on accessible Fusion Middleware data over HTTP. The scope change in the CVSS vector (S:C) indicates successful exploitation can extend impact to additional co-deployed Oracle middleware components beyond DMS itself. No public exploit has been identified, EPSS stands at a low 0.03%, and SSVC records exploitation as none - positioning this as a normal-cycle patch priority rather than an emergency response.
Technical ContextAI
Oracle Fusion Middleware's Dynamic Monitoring Service is a Java EE diagnostics and metrics framework embedded in Oracle's middleware stack, exposing management endpoints reachable over HTTP. The vulnerability is rooted in CWE-284 (Improper Access Control), meaning the DMS component does not correctly enforce authorization boundaries for low-privileged users - allowing access to data or operations beyond what their privilege level should permit. The CPE string cpe:2.3:a:oracle_corporation:oracle_fusion_middleware:*:*:*:*:*:*:*:* broadly identifies the Oracle Fusion Middleware product family; Oracle's advisory specifically pins the affected versions at 12.2.1.4.0 and 14.1.2.0.0. The S:C scope change in the CVSS vector reflects the architectural reality that DMS is a cross-cutting service whose improper behavior can expose data or capabilities belonging to other Fusion Middleware subsystems sharing the same deployment.
RemediationAI
Apply Oracle's Critical Patch Update for April 2026, which addresses this vulnerability; the full advisory with patch download instructions and prerequisites is at https://www.oracle.com/security-alerts/cpuapr2026.html. The exact patched version number is not confirmed in the available data beyond the CPU reference - consult the advisory directly to identify the specific patch artifact for your version (12.2.1.4.0 or 14.1.2.0.0). As a compensating control while patching, restrict HTTP access to Dynamic Monitoring Service endpoints at the network perimeter or web tier to only authorized administrative networks, reducing the pool of users who can reach the DMS interface; note this does not remediate the underlying authorization flaw and must be validated against your specific deployment topology. Additionally, enforce least-privilege principles on Fusion Middleware accounts to limit the data any low-privileged user can influence even if the access control bypass is triggered.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today