CVE-2026-83020

CVE-2026-83020 is a critical (CVSS 3.1 base score 10.0) vulnerability in the Centralized Thirdparty Jars component of Oracle Platform Security for Java (OPSS), part of Oracle Fusion Middleware, affecting versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable by an unauthenticated attacker with network access via HTTP, requiring no privileges and no user interaction. Successful exploitation results in complete takeover of Oracle Platform Security for Java, and because of a scope change, attacks may significantly impact additional products beyond OPSS itself, with full impact to confidentiality, integrity, and availability. Organizations running WebLogic Server or other Fusion Middleware deployments on the affected OPSS versions are exposed wherever the relevant HTTP endpoints are reachable. As of now, the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog and no public proof-of-concept is known.

What to do: Apply the Oracle Critical Patch Update (CPU) that remediates CVE-2026-83020 to all OPSS installations on 12.2.1.4.0 and 14.1.2.0.0, prioritizing any systems with HTTP endpoints exposed to untrusted networks. Restrict network access to administrative and OPSS-related HTTP endpoints so only trusted hosts can reach them, and monitor logs for unauthenticated HTTP requests targeting Fusion Middleware/OPSS paths until patching is complete.