Oracle Security Service CVE-2026-61217

Exploitation requires the attacker to hold a low-privileged account with network-level access to the target Oracle Fusion Middleware instance via TLS (PR:L, AV:N). The attack complexity is High (AC:H), meaning specific conditions beyond standard network access must exist - likely involving timing, session state, or other non-trivial preconditions inherent to the SSL API flaw. Critically, human interaction from a person other than the attacker is required (UI:R), which limits exploitation to scenarios where a legitimate user can be induced to perform an action during the attack window (e.g., a social engineering lure or concurrent legitimate SSL session). Only Oracle Security Service version 12.2.1.4.0 is confirmed affected. Exploitation is limited to environments where Oracle Fusion Middleware is deployed and the Oracle SSL API is accessible over the network; organizations that have restricted SSL API access to isolated network segments or that enforce strong egress/ingress controls significantly reduce real-world risk.

The CVSS 3.1 score of 6.4 (Medium) reflects a nuanced threat profile: while the C:H and I:H impact metrics indicate severe data compromise potential, the constraining factors - AC:H (high attack complexity, difficult to exploit), PR:L (low privilege required, not unauthenticated), and UI:R (requires victim interaction) - materially reduce the probability of opportunistic or automated exploitation. No EPSS data was provided in the available intelligence, limiting quantitative exploitation probability assessment. There is no CISA KEV listing and no public POC identified, aligning with a lower real-world risk posture despite the moderate-high CVSS impacts. The 'Authentication Bypass' tag creates a notable tension: CVSS PR:L indicates authentication is required to initiate the attack, yet the bypass label implies authentication controls are circumvented upon success - this is consistent with a scenario where a low-privilege user can bypass authorization to access data beyond their permission scope. The AC:H rating is particularly important: defenders should not treat this as easily exploitable, and its real-world priority should be elevated primarily in Oracle-heavy enterprise environments where the SSL API is directly accessible over network paths. The missing EPSS score and lack of KEV or POC should be re-evaluated when Oracle releases further advisory detail.

A low-privileged attacker with a valid account and network access to the Oracle Fusion Middleware SSL endpoint crafts a malicious TLS-based interaction targeting the Oracle SSL API authentication bypass flaw, while simultaneously engineering victim interaction - such as inducing a higher-privileged user to perform a legitimate SSL operation during the attack window. Upon successful exploitation, the attacker gains unauthorized read and write access to critical data accessible by Oracle Security Service, effectively bypassing intended authorization controls. No public POC exists at time of analysis, and the AC:H rating indicates this scenario requires specific environmental conditions to execute reliably.