Oracle Fusion Middleware CVE-2026-91616

Exploitation targets the Remote Diagnostic Agent component of Oracle Middleware Common Libraries and Tools on affected versions 12.2.1.4.0 and 14.1.1.0.0, reachable over HTTP without authentication (PR:N, UI:N). The key LIMITING factor is the high attack complexity (AC:H): Oracle classifies this as 'difficult to exploit,' meaning success depends on conditions beyond the attacker's control - likely specific timing, server state, or non-default exposure of the diagnostic interface - rather than a simple repeatable request. Impact is bounded to read access to a subset of data (C:L), with no write or availability consequence. Realistic risk is further reduced where the Remote Diagnostic Agent / middleware management endpoints are not exposed to untrusted networks.

This is a genuinely low-priority issue despite the unauthenticated network vector. The CVSS 3.1 base score is only 3.7 (LOW), and the vector tells a consistent story: AV:N/PR:N/UI:N means a remote, unauthenticated attacker can reach it over HTTP, but AC:H flags high attack complexity - exploitation depends on conditions outside the attacker's control (timing, configuration, or specific state), making reliable exploitation difficult. The impact is limited to C:L (partial read access to a subset of data) with no integrity or availability effect, so there is no code execution, no data modification, and no denial of service. No EPSS score, CISA KEV listing, POC, or SSVC data was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The signals are internally consistent - a low-severity information-disclosure bug that is hard to trigger. Note one metadata conflict: the input Tags include 'Authentication Bypass,' but the description describes unauthorized read access to a data subset, not a bypass of authentication; the PR:N simply reflects that the affected function requires no privileges, not that an auth control is circumvented. Treat this as routine-patch priority, not emergency.

A remote, unauthenticated attacker sends specially crafted HTTP requests to an exposed Oracle Middleware Common Libraries and Tools instance (Remote Diagnostic Agent component), attempting to trigger the flaw under the narrow conditions required by the high attack complexity. If successful, the attacker reads a limited subset of accessible data (e.g., diagnostic or configuration information). No public exploit code has been identified for this CVE.