Unauthorized Access Flaw in Oracle Fusion Middleware's Java Security Component
CVE-2026-82994

9.8CRITICAL

Key Information:

Vendor

Oracle
Status
Oracle Platform Security For Java
Vendor
CVE Published:
15 September 2026

What is CVE-2026-82994?

A critical security vulnerability exists in the Oracle Platform Security for Java component of Oracle Fusion Middleware, specifically in the Centralized Thirdparty Jars feature. This flaw can be exploited by an unauthenticated attacker with network access through LDAP, potentially allowing the attacker to take control of Oracle Platform Security for Java. The affected versions include 12.2.1.4.0 and 14.1.2.0.0. Oracle has released an advisory with recommended actions to mitigate the risk associated with this vulnerability.

Affected Version(s)

Oracle Platform Security for Java 12.2.1.4.0

Oracle Platform Security for Java 14.1.2.0.0

References

https://www.oracle.com/security-alerts/cspusep2026.html
vendor-advisory

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.