CVE-2026-35232
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
An easily exploitable vulnerability exists in Oracle Fusion Middleware (Dynamic Monitoring Service component) in versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via HTTP can compromise the system, requiring user interaction; the attack may impact additional products (scope change).
Risk Assessment
Unauthorized update, insert, or delete access to some Oracle Fusion Middleware data, as well as unauthorized read access to a subset of data, is possible.
Recommendation
Apply the Oracle Critical Patch Update security fixes for the affected versions.
Other vulnerabilities in Oracle Fusion Middleware
See all- CVE-2026-101590Critical
Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-microprofile-security) affecting versions 4.0.0-4.5.5. An unauthenticated attacker with network access via HTTP can easily exploit it to gain unauthorized creation, deletion, or modification access to critical data.
- CVE-2026-60388Critical
Vulnerability in Oracle Fusion Middleware Service Delivery Platform (component: Messaging Enabler). Unauthenticated attacker via network (T3, IIOP) can take over the platform.
- CVE-2026-60387Critical
Vulnerability in Oracle Fusion Middleware Service Delivery Platform (component: Messaging Enabler). Unauthenticated attacker via network (T3, IIOP) can take over the platform.
- CVE-2026-60380Critical
Vulnerability in Oracle Fusion Middleware Service Delivery Platform (component: Messaging Enabler). Unauthenticated attacker via network (HTTP) can take over the platform.
- CVE-2026-60374Critical
Vulnerability in Oracle Fusion Middleware Service Delivery Platform (component: Messaging Enabler). Unauthenticated attacker via network (T3, IIOP) can take over the platform.
- CVE-2012-0518MediumActively exploited
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3.0 allows remote attackers to affect integrity via unknown vectors related to Redirects. This is a different vulnerability than CVE-2012-3175.
- CVE-2026-61099High
Vulnerability in Oracle WebCenter Enterprise Capture product (Oracle Fusion Middleware) in Client Bundle component. Affects versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via HTTP can take over the system.
- CVE-2026-61098High
Vulnerability in Oracle WebCenter Enterprise Capture product (Oracle Fusion Middleware) in Client Bundle component. Affects versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via HTTP can take over the system.
- CVE-2026-60657High
Vulnerability in Oracle WebCenter Content (part of Oracle Fusion Middleware) versions 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit, requires low privileges and user interaction, but may affect other products. Allows unauthorized access and modification of critical data.
- CVE-2026-60654High
Vulnerability in Oracle WebCenter Content (part of Oracle Fusion Middleware) versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via HTTP can take over the system.
Original NVD description (English source)
Vulnerability in Oracle Fusion Middleware (component: Dynamic Monitoring Service). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Fusion Middleware. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Fusion Middleware, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Fusion Middleware accessible data as well as unauthorized read access to a subset of Oracle Fusion Middleware accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS