---
id: "CVE-2026-91467"
kind: "vulnerability"
aliases: ["CVE-2026-91467"]
title: "Oracle Fusion Middleware Control: framework flaw allows takeover with physical access"
severity: "medium"
cvss: 6.6
epss: 0.00188
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["java", "oracle-fusion-middleware", "runtime", "self-hosted"]
not_affected_if: ["no-fusion-middleware-control", "other-versions"]
published_at: "2026-10-20T22:20:50+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91467", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91467", "first_seen_at": "2026-10-25T12:38:51+00:00"}]
---

# Oracle Fusion Middleware Control: framework flaw allows takeover with physical access

Oracle Fusion Middleware Control has a flaw in its Framework component affecting versions 12.2.1.4.0 and 14.1.2.0.0. The sources say an attacker with physical access and a user's interaction can take over the product.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Oracle Fusion Middleware version against `12.2.1.4.0` and `14.1.2.0.0`
- Confirm whether Fusion Middleware Control is deployed on the host

## Fix

- Apply the Oracle Critical Patch Update fix for Fusion Middleware Control (fix version unknown in the sources)

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91467
- 2026-10-25T12:38:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91467

## From the sources

Vulnerability in the Oracle Fusion Middleware Control product of Oracle Fusion Middleware (component: Framework).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows physical access to compromise Oracle Fusion Middleware Control.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Fusion Middleware Control. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_