CVE-2026-82997

CVE-2026-82997 is a critical (CVSS 9.9) vulnerability in the Messaging Enabler component of Oracle's Service Delivery Platform, part of Oracle Fusion Middleware, affecting versions 12.2.1.4.0 and 14.1.2.0.0. A remote attacker with only low-privileged (authenticated) access to the T3 or IIOP network interfaces can exploit the flaw easily and completely take over the Service Delivery Platform, and because the vulnerability has a scope change, successful attacks can also significantly impact additional products, with high impact to confidentiality, integrity, and availability. The affected deployments are Oracle Communications Service Delivery Platform installations at communications service providers, primarily telecom operators running carrier-grade messaging infrastructure. No public proof-of-concept code is known and the flaw is not on CISA's Known Exploited Vulnerabilities catalog, so exploitation in the wild is not currently evidenced.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-82997 to all Service Delivery Platform 12.2.1.4.0 and 14.1.2.0.0 installations. Until patched, block or tightly firewall the T3 and IIOP listeners (commonly WebLogic ports such as 7001/7002 and the IIOP port) at the network perimeter so only trusted administrative subnets can reach them, and consider disabling IIOP entirely if unused. Review low-privileged account activity and WebLogic/T3 session logs for anomalous connections, and verify with external scanning that no SDP protocol ports are exposed to the internet.