CVE-2026-83011

CVE-2026-83011 is a difficult-to-exploit, unauthenticated vulnerability in the Centralized Thirdparty Jars component of Oracle Platform Security for Java (OPSS), part of Oracle Fusion Middleware, affecting versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP who is able to overcome the high attack complexity could compromise OPSS, and successful attacks can result in a complete takeover of the product with high impact on confidentiality, integrity, and availability (CVSS 3.1 base score 8.1). Organizations running affected Fusion Middleware deployments (typically WebLogic-based environments where OPSS is bundled) are exposed wherever the relevant services are reachable over HTTP. Because exploitation is rated difficult, no public proof-of-concept exists, and the flaw is not listed in CISA's Known Exploited Vulnerabilities catalog, real-world risk is currently lower than the score alone suggests. Defenders should nonetheless treat internet-reachable instances as priority patch candidates.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-83011 to affected Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0 deployments as soon as it is available for your release line. Restrict HTTP network access to WebLogic/OPSS admin and managed servers so they are reachable only from trusted networks, and verify that no affected instances are internet-facing. Review logs for unauthenticated anomalous HTTP requests against OPSS endpoints as an indicator of attempted exploitation.