Fusion Middleware Control CVE-2026-91467

Exploitation requires physical access (AV:P) to the system hosting Oracle Fusion Middleware Control AND human interaction (UI:R) from a legitimate user other than the attacker, affecting Oracle Fusion Middleware Control versions 12.2.1.4.0 and 14.1.2.0.0 (Framework component). These two factors - local physical proximity plus a tricked operator - are the primary limiters; the flaw cannot be triggered remotely or network-side and requires no attacker authentication (PR:N) once physical access and victim interaction are obtained. The description does not name a specific toggle or non-default mode, so exploitation applies to affected versions generally rather than being gated on a particular configuration.

This is a high-CVSS-but-moderate-real-risk issue whose score (6.6, Medium) is held down almost entirely by the attack vector. The CVSS 3.1 vector confirms AV:P (physical access required), AC:L, PR:N (unauthenticated), UI:R (human interaction from a person other than the attacker), S:U, with full C:H/I:H/A:H impact resulting in takeover of Oracle Fusion Middleware Control. The combination of physical access AND required victim interaction makes remote mass-exploitation impossible, which is why the impact is severe but the base score stays Medium. No EPSS score, KEV listing, or POC was provided in the input; there is no public exploit identified at time of analysis and no evidence of active exploitation. Signals are consistent (no conflicts), but note the input Tags label this 'Information Disclosure' whereas the CVSS vector and description describe full confidentiality, integrity AND availability compromise (takeover) - treat the impact as takeover, not mere disclosure. Overall this is a low-urgency, high-impact-if-reached issue: prioritize patching for high-value/physically-exposed Fusion Middleware consoles but it does not warrant emergency response absent exploitation evidence.

An attacker with physical access to a workstation or console session running Oracle Fusion Middleware Control tricks a legitimate operator (a person other than the attacker) into performing an action that triggers the flaw, resulting in takeover of the Fusion Middleware Control console. Because the CVSS vector requires AV:P and UI:R, the attack cannot be performed remotely and depends on both proximity and victim cooperation. No public exploit code is identified at time of analysis.