Oracle Fusion Middleware CVE-2026-91617

Exploitation requires the attacker to already possess a low-privileged authenticated local logon (PR:L, AV:L) on the infrastructure host where Oracle Middleware Common Libraries and Tools executes, and interaction specifically with the Remote Diagnostic Agent component. There is no remote network path and no user interaction is needed (UI:N), but the mandatory pre-existing local account and authenticated access are the key limiting factors that constrain real-world exploitability. Affected deployments are limited to supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0; impact is confined to confidentiality (C:H), with no integrity or availability consequences.

This is a moderate-severity, low-priority issue despite affecting enterprise Oracle middleware. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 5.5) is self-consistent and describes a LOCAL, authenticated (PR:L), low-complexity information-disclosure flaw with HIGH confidentiality impact but NO integrity or availability impact - matching the description's claim of 'logon to the infrastructure' and 'unauthorized access to critical data.' No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no signal of active or imminent exploitation; status is 'no public exploit identified at time of analysis.' The local attack vector plus required pre-existing authenticated access substantially limits real-world risk: this is not a remotely weaponizable, worm-able flaw but a privilege-to-data-disclosure issue usable by someone already on the host. CONFLICTING SIGNAL: the input Tag 'Authentication Bypass' contradicts the CVSS vector, which explicitly requires privileges (PR:L) and yields only confidentiality impact - this is an information-disclosure/local-access flaw, not an authentication bypass; treat the tag as unreliable. Overall: prioritize routine patching via the October 2026 CPU, not emergency response.

An attacker who already holds a low-privileged local account on the server running Oracle Middleware Common Libraries and Tools abuses the Remote Diagnostic Agent component to read sensitive data they should not be able to access. Because the attack vector is local (AV:L) and requires existing authentication (PR:L), exploitation presupposes prior foothold rather than remote entry. No public exploit code was identified in the provided intelligence.