CVE-2026-35232
Unauthorized Data Access via Dynamic Monitoring Service in Oracle Fusion Middleware
Publication date: 2026-04-21
Last updated on: 2026-04-27
Assigner: Oracle
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| oracle | fusion_middleware | 12.2.1.4.0 |
| oracle | fusion_middleware | 14.1.2.0.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Oracle Fusion Middleware's Dynamic Monitoring Service component, specifically affecting versions 12.2.1.4.0 and 14.1.2.0.0.
It is easily exploitable by a low privileged attacker who has network access via HTTP. The attack requires human interaction from someone other than the attacker.
Successful exploitation can lead to unauthorized update, insertion, or deletion of some accessible data within Oracle Fusion Middleware, as well as unauthorized read access to a subset of that data.
How can this vulnerability impact me? :
If exploited, this vulnerability can allow an attacker to compromise Oracle Fusion Middleware, leading to unauthorized modification and disclosure of data.
This could result in loss of data integrity and confidentiality within the affected system.
Because the scope of the attack may extend beyond Oracle Fusion Middleware, additional products could also be significantly impacted.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows unauthorized read and modification access to certain data within Oracle Fusion Middleware, which could potentially lead to data breaches or unauthorized data manipulation.
Such unauthorized access and data compromise may impact compliance with data protection regulations like GDPR and HIPAA, which require safeguarding the confidentiality and integrity of sensitive data.
However, the provided information does not explicitly state the direct effects on compliance with these standards.