CVE-2026-83069

CVE-2026-83069 is a high-severity vulnerability in the Framework component of Oracle Fusion Middleware Control, affecting versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable by a low-privileged (authenticated) attacker with network access via HTTP, who can escalate their access and ultimately take over the entire Oracle Fusion Middleware Control environment. A successful attack results in complete compromise of confidentiality, integrity, and availability of the affected system, reflected in a CVSS 3.1 base score of 8.8. Organizations running either affected version with the middleware control interface reachable over the network are exposed, particularly if low-privilege accounts are broadly available. The flaw is not listed in the CISA Known Exploited Vulnerabilities catalog and no public proof of concept is known, so there is no evidence of active exploitation at this time.

What to do: Apply the Oracle Critical Patch Update that addresses CVE-2026-83069 to systems running Fusion Middleware Control 12.2.1.4.0 or 14.1.2.0.0, prioritizing any instance whose administration console is reachable over HTTP. Restrict network access to the Fusion Middleware Control console to trusted admin networks or VPN, audit low-privileged accounts for signs of abuse, and review authentication logs for anomalous activity from low-privilege users.