CVE-2026-82996

CVE-2026-82996 is a vulnerability in the Centralized Thirdparty Jars component of Oracle Platform Security for Java (OPSS), part of Oracle Fusion Middleware, affecting versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable by a low-privileged attacker who already has logon access to the host or infrastructure where OPSS executes — the attack vector is local, not network-facing. A successful exploit allows the attacker to escalate privileges and take over OPSS entirely, with high impact on confidentiality, integrity, and availability (CVSS 3.1 base score 7.8). Because OPSS underpins security policy enforcement across WebLogic and Fusion Middleware deployments, a takeover could compromise the security posture of applications hosted on the same infrastructure. No public proof of concept is known, the flaw is not on the CISA KEV list, and there is no evidence of in-the-wild exploitation.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-82996 to all OPSS 12.2.1.4.0 and 14.1.2.0.0 installations, prioritizing hosts where multiple users or applications have local logon. Restrict interactive and service accounts on middleware hosts to the minimum OS privileges needed, since exploitation requires local low-privilege access. Review local account activity and privilege changes on Fusion Middleware servers for signs of escalation.