CVE-2026-82998

CVE-2026-82998 is a critical (CVSS 9.9) vulnerability in the Messaging Enabler component of Oracle Service Delivery Platform, part of Oracle Fusion Middleware, affecting versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploited by a low-privileged (authenticated) attacker with network access via the T3 or IIOP protocols, which are commonly used for Java remote method invocation in WebLogic-based deployments. A successful attack results in complete takeover of the Service Delivery Platform, and because the vulnerability carries a scope change (S:C), compromises can significantly impact additional products beyond the initial target, with high impacts to confidentiality, integrity, and availability. The product is primarily deployed by telecommunications carriers and large service providers running Oracle Communications software. No public proof-of-concept exists, the flaw is not on the CISA KEV list, and no exploitation in the wild is currently known.

What to do: Apply the Oracle Critical Patch Update that remediated CVE-2026-82998 to all Service Delivery Platform instances on 12.2.1.4.0 and 14.1.2.0.0. Restrict or disable T3 and IIOP network access at the perimeter so only trusted internal hosts can reach those ports, and verify no SDP T3/IIOP listeners are internet-exposed via external scanning. Review authentication logs for unexpected low-privilege account activity and rotate credentials on affected systems as a precaution.