{"id":"CVE-2026-91467","kind":"vulnerability","aliases":["CVE-2026-91467"],"related":[],"title":"Oracle Fusion Middleware Control: framework flaw allows takeover with physical access","description":"Vulnerability in the Oracle Fusion Middleware Control product of Oracle Fusion Middleware (component: Framework).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows physical access to compromise Oracle Fusion Middleware Control.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Fusion Middleware Control. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).","summary":"Oracle Fusion Middleware Control has a flaw in its Framework component affecting versions 12.2.1.4.0 and 14.1.2.0.0. The sources say an attacker with physical access and a user's interaction can take over the product.","severity":"medium","cvss":6.6,"epss":0.00188,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","oracle-fusion-middleware","runtime","self-hosted"],"not_affected_if":["no-fusion-middleware-control","other-versions"],"how_to_check":"- Check the installed Oracle Fusion Middleware version against `12.2.1.4.0` and `14.1.2.0.0`\n- Confirm whether Fusion Middleware Control is deployed on the host","fix":"- Apply the Oracle Critical Patch Update fix for Fusion Middleware Control (fix version unknown in the sources)","status":"open","published_at":"2026-10-20T22:20:50+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T03:46:49+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T03:46:49Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for Fusion Middleware Control (fix version unknown in the sources)","reach":"local","title":"Oracle Fusion Middleware Control: framework flaw allows takeover with physical access","impact":"high","summary":"Oracle Fusion Middleware Control has a flaw in its Framework component affecting versions 12.2.1.4.0 and 14.1.2.0.0. The sources say an attacker with physical access and a user's interaction can take over the product.","category":"runtime","nicknames":[],"who_cares":["oracle-fusion-middleware","java","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"attacker takes over Fusion Middleware Control with physical access","analyst_note":"Check Oracle Security Alert advisory for fix version and whether a remote path exists; sources only give the NVD entry.","how_to_check":"- Check the installed Oracle Fusion Middleware version against `12.2.1.4.0` and `14.1.2.0.0`\n- Confirm whether Fusion Middleware Control is deployed on the host","needs_analyst":true,"not_affected_if":["other-versions","no-fusion-middleware-control"],"who_is_affected":"Teams running Oracle Fusion Middleware Control 12.2.1.4.0 or 14.1.2.0.0 are listed as affected. The sources describe exploitation requiring physical access and a human action by someone other than the attacker, so remotely reachable deployments are not described. Teams without these versions can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000637,"input_tokens":3486,"output_tokens":576,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-91467':14A,17A '/av':136C '12.2.1.4.0':40B,81C '14.1.2.0.0':42B,83C '3.1':123C,135C '6.6':126C 'access':11A,50B,89C 'affect':38B,79C 'allow':7A,87C 'attack':47B,97C,107C,109C 'avail':130C 'base':124C 'compon':37B,73C 'compromis':91C 'confidenti':127C 'control':4A,30B,67C,95C,121C 'cve':12A,15A 'cvss':122C,132C,134C 'easili':84C 'exploit':85C 'flaw':6A,33B 'framework':5A,36B,74C 'fusion':2A,21B,28B,65C,71C,93C,119C 'h':144C 'h/a':143C 'h/i':142C 'host':26B 'human':99C 'impact':131C 'integr':128C 'interact':55B,100C 'java':18B 'l/pr':138C 'middlewar':3A,22B,29B,66C,72C,94C,120C 'n/ui':139C 'oracl':1A,20B,27B,64C,70C,92C,118C 'oracle-fusion-middlewar':19B 'p/ac':137C 'person':103C 'physic':10A,49B,88C 'product':60B,68C 'r/s':140C 'requir':98C 'result':114C 'runtim':23B 'say':45B 'score':125C 'self':25B 'self-host':24B 'sourc':44B 'success':96C,108C 'support':75C 'take':57B 'takeov':8A,116C 'u/c':141C 'user':53B 'vector':133C 'version':39B,76C 'vulner':61C,86C,112C","nicknames":[],"mitigations":[],"who_affected":"Teams running Oracle Fusion Middleware Control 12.2.1.4.0 or 14.1.2.0.0 are listed as affected. The sources describe exploitation requiring physical access and a human action by someone other than the attacker, so remotely reachable deployments are not described. Teams without these versions can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:50+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91467","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91467","severity":null,"published_at":"2026-10-20T22:20:50+00:00","modified_at":"2026-10-21T18:44:55+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"epss","external_id":"CVE-2026-91467","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91467","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}