CVE-2026-83000

Oracle Fusion Middleware's Service Delivery Platform contains a critical vulnerability in its Messaging Enabler component, affecting versions 12.2.1.4.0 and 14.1.2.0.0. The flaw is easily exploitable by an unauthenticated attacker with network access via HTTP, requiring no privileges or user interaction. A successful attack allows complete takeover of the Service Delivery Platform, with high impact on the confidentiality, integrity, and availability of the system (CVSS 3.1 base score 9.8). Organizations running telecom-grade Oracle SDP deployments on the affected versions are exposed wherever the Messaging Enabler HTTP interfaces are reachable. No public proof-of-concept exists and the CVE is not on the CISA Known Exploited Vulnerabilities catalog, so exploitation status is currently none known.

What to do: Apply the Oracle Critical Patch Update that remediates this CVE to all Service Delivery Platform instances running 12.2.1.4.0 or 14.1.2.0.0. Until patched, restrict network access to the Messaging Enabler HTTP endpoints so only trusted internal systems can reach them. Review HTTP access logs on SDP servers for unauthenticated or anomalous requests to Messaging Enabler endpoints.