CVE-2026-61217
Awaiting Analysis Awaiting Analysis - Queue

Oracle Security Service TLS Access Control Flaw

Publication date: 2026-07-21

Last updated on: 2026-07-22

Assigner: Oracle

Description
Vulnerability in the Oracle Security Service product of Oracle Fusion Middleware (component: Oracle SSL API). The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows low privileged attacker with network access via TLS to compromise Oracle Security Service. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Security Service accessible data as well as unauthorized access to critical data or complete access to all Oracle Security Service accessible data. CVSS 3.1 Base Score 6.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-21
Last Modified
2026-07-22
Generated
2026-08-11
AI Q&A
2026-07-22
EPSS Evaluated
2026-08-09
NVD
CVE-2026-61217
EUVD
EUVD-2026-47416

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
oracle oracle_fusion_middleware 12.2.1.4.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
CWE-290 This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
CWE-284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a vulnerability in Oracle Security Service within Oracle Fusion Middleware (component: Oracle SSL API). It affects version 12.2.1.4.0 and allows a low-privileged attacker with network access via TLS to compromise the service. Exploitation requires human interaction beyond the attacker's control.

Detection Guidance

This vulnerability cannot be directly detected with specific commands as the provided CVE data does not include detection methods or technical details for mitigation. The vulnerability affects Oracle Security Service in Oracle Fusion Middleware 12.2.1.4.0 and requires manual investigation of the Oracle SSL API component.

Impact Analysis

An attacker could exploit this to gain unauthorized access to critical data, modify or delete data, or create new data within Oracle Security Service. This could lead to data breaches, data integrity issues, or unauthorized system access.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of critical data, which may violate compliance requirements under GDPR (data protection and integrity) and HIPAA (confidentiality and integrity of protected health information). The potential for unauthorized data access or modification could result in non-compliance with these regulations.

Mitigation Strategies

Apply the latest Oracle Critical Patch Update for Oracle Fusion Middleware 12.2.1.4.0 to address the vulnerability in the Oracle Security Service component.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-61217. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart