CVE-2026-82994

Oracle Platform Security for Java (OPSS), a component of Oracle Fusion Middleware, contains a critical flaw in its Centralized Thirdparty Jars component affecting versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated remote attacker who can reach the product over LDAP can exploit the vulnerability with low complexity and no user interaction or privileges required. A successful attack results in a complete takeover of Oracle Platform Security for Java, with high impact on confidentiality, integrity, and availability (CVSS 3.1 base score 9.8). Organizations running the affected Fusion Middleware releases, particularly those with LDAP listeners reachable from untrusted networks, are at risk. There is no evidence of in-the-wild exploitation and no public proof-of-concept is known, and the CVE is not on the CISA Known Exploited Vulnerabilities catalog.

What to do: Apply the Oracle Critical Patch Update that remediates this CVE to installations of Oracle Platform Security for Java 12.2.1.4.0 and 14.1.2.0.0 as soon as the fix is available. Until patched, restrict network access so LDAP listeners and Fusion Middleware administrative endpoints are not reachable from untrusted or internet-facing networks. Review LDAP and middleware logs for unauthenticated or anomalous bind/query activity against OPSS endpoints and monitor Oracle's advisories for updates.