CVE-2026-82999

Oracle Service Delivery Platform, a component of Oracle Fusion Middleware (specifically its Messaging Enabler component), contains an easily exploitable vulnerability in versions 12.2.1.4.0 and 14.1.2.0.0. A remote attacker with only low-privileged credentials and HTTP network access to the platform can exploit the flaw, which successful exploitation results in a complete takeover of the Service Delivery Platform. Because the vulnerability has a scope change (CVSS S:C), successful attacks may also significantly impact additional products beyond Service Delivery Platform itself, with high impact on confidentiality, integrity, and availability (CVSS 3.1 base score 9.9). Affected organizations are typically communications and digital service providers running Oracle SDP on the listed Fusion Middleware versions. No public proof of concept is known and the flaw is not on the CISA Known Exploited Vulnerabilities catalog, so exploitation status is currently none known.

What to do: Apply the latest Oracle Critical Patch Update to Service Delivery Platform installations running 12.2.1.4.0 or 14.1.2.0.0 as soon as patches are available. Restrict HTTP access to SDP and Messaging Enabler interfaces to trusted administrative networks, and enforce least privilege and strong credential controls for all SDP accounts since valid low-privileged access is required. Given the scope-change impact on additional products, review logs for anomalous activity by low-privileged accounts and assess adjacent systems for compromise.