What is the CVSS score of CVE-2026-35252?

CVE-2026-35252 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Oracle Security Service CVE-2026-35252

EUVD-2026-24465 MEDIUM

Improper Access Control (CWE-284)

2026-04-21 oracle

Authentication Bypass Oracle Oracle Security Service Oracle Corporation

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

vuln.today AI

6.4 MEDIUM

Independent assessment agrees with Oracle's vector: network HTTPS surface, high complexity and user interaction required, low-privileged account needed, no availability impact, scope unchanged.

3.1 AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 05:41 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24465

CVE Published

Apr 21, 2026 - 20:35 nvd

MEDIUM 6.4

DescriptionCVE.org

Vulnerability in the Oracle Security Service product of Oracle Fusion Middleware (component: C Oracle SSL API). Supported versions that are affected are 12.2.1.4.0 and 12.1.3.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Security Service. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Security Service accessible data as well as unauthorized access to critical data or complete access to all Oracle Security Service accessible data. CVSS 3.1 Base Score 6.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N).

AnalysisAI

Improper access control (CWE-284) in the C Oracle SSL API component of Oracle Security Service 12.1.3.0.0 and 12.2.1.4.0 - part of Oracle Fusion Middleware - allows a low-privileged network attacker to compromise the service via HTTPS, resulting in unauthorized read access to all critical data and unauthorized creation, modification, or deletion of critical data. The attack is constrained by high complexity and mandatory human interaction from a third party, making automated or mass exploitation infeasible; EPSS exploitation probability is extremely low at 0.03% and CISA SSVC classifies exploitation as none. No public exploit has been identified at time of analysis.

Technical ContextAI

Oracle Security Service is a Fusion Middleware component that provides SSL/TLS and cryptographic services to Oracle middleware products; the specific vulnerable surface is the C Oracle SSL API, the low-level C-language binding through which higher-layer middleware calls into the SSL stack. CWE-284 (Improper Access Control) indicates the root cause is insufficient enforcement of authorization controls within this API layer - consistent with the 'Authentication Bypass' tag, suggesting the flaw allows an authenticated but low-privileged caller to bypass authorization gates and access data or operations reserved for higher-privilege principals. The HTTPS attack vector confirms exploitation occurs over the SSL/TLS channel itself, making this a flaw in the very component responsible for securing that communication. CPE: cpe:2.3:a:oracle_corporation:oracle_security_service:*:*:*:*:*:*:*:*, with confirmed affected versions 12.2.1.4.0 and 12.1.3.0.0 per the Oracle April 2026 CPU and EUVD-2026-24465.

RemediationAI

Apply the Oracle Critical Patch Update for April 2026, available at https://www.oracle.com/security-alerts/cpuapr2026.html, which addresses CVE-2026-35252. Exact patched version identifiers within the CPU are not independently confirmed from available data - consult Oracle My Oracle Support (MOS) for the specific patch IDs applicable to Fusion Middleware 12.1.3.0.0 and 12.2.1.4.0. If immediate patching is not feasible, restrict network access to Oracle Security Service HTTPS endpoints to trusted network segments and authenticated internal users only, reducing exposure from untrusted low-privileged accounts; note this does not eliminate risk from insider or compromised low-privileged accounts. Because the attack chain requires human interaction from a legitimate user, organizations should additionally monitor for suspicious session activity and consider enforcing multi-factor authentication on accounts with access to the service to raise the effective privilege bar. Neither workaround eliminates the underlying flaw and patching remains the definitive fix.