CVE-2026-82997 in Service Delivery Platform
Summary
by MITRE • 09/16/2026
Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Service Delivery Platform. While the vulnerability is in Service Delivery Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Service Delivery Platform. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability resides within the Messaging Enabler component of Oracle Fusion Middleware’s Service Delivery Platform, specifically affecting versions 12.2.1.4.0 and 14.1.2.0. This critical security flaw allows for remote code execution or system compromise through specific network protocols, namely T3 and IIOP. The presence of this vulnerability in the Messaging Enabler highlights a significant weakness in how Oracle Fusion Middleware handles incoming requests over these legacy communication channels. These protocols are often used for distributed object communications and RMI (Remote Method Invocation) operations within Java-based enterprise environments. The fact that low-privileged attackers can exploit this flaw indicates insufficient input validation or improper handling of serialized data structures sent via T3 or IIOP, which is a common vector for deserialization attacks in Java applications.
The operational impact of this vulnerability is severe due to its high CVSS 3.1 Base Score of 9.9. This score reflects critical levels of Confidentiality, Integrity, and Availability impacts. An attacker who successfully exploits this flaw can achieve complete takeover of the Service Delivery Platform instance. This means they gain full control over the underlying operating system or application server environment running Oracle Fusion Middleware. The ability to execute arbitrary code with elevated privileges allows an adversary to install malware, exfiltrate sensitive data, modify configurations, and use the compromised host as a pivot point for further network intrusion. The scope change noted in the vulnerability description is particularly dangerous; while the technical flaw originates in the Service Delivery Platform component, the consequences extend beyond that specific module. Because Fusion Middleware components are deeply integrated, compromising one part can lead to the compromise of adjacent services and data stores, effectively breaking down security boundaries within the middleware architecture.
From a classification perspective, this vulnerability aligns with CWE-502, Deserialization of Untrusted Data, which is frequently associated with T3 protocol exploits in WebLogic Server environments. The use of IIOP also suggests potential issues related to improper access control or insecure remote procedure call handling, potentially mapping to CWE-749 or CWE-862 depending on the specific mechanism exploited. In terms of offensive security frameworks, this vulnerability facilitates Initial Access via Network Service Exploitation and Privilege Escalation if the initial foothold is gained with low privileges but leads to system-level compromise. The ATT&CK technique T1059, Command and Scripting Interpreter, would likely be employed post-exploitation as attackers leverage their new access to execute commands on the compromised host.
Mitigation strategies must prioritize immediate patching of Oracle Fusion Middleware to the latest available version that addresses this specific CVE. Organizations should also consider network-level controls such as firewall rules or Web Application Firewalls (WAF) to restrict T3 and IIOP traffic to only trusted internal subnets, effectively blocking external access vectors if these protocols are not strictly required for business operations. Disabling unnecessary services is a critical step; since the vulnerability leverages specific protocol handlers, turning off the T3 listener on ports typically used by WebLogic or Fusion Middleware can significantly reduce the attack surface. Additionally, implementing strict input validation and avoiding deserialization of untrusted data in custom messaging enablers can provide defense-in-depth measures. Security teams should monitor for anomalous network traffic patterns indicative of exploitation attempts against these protocols and ensure that all middleware components are regularly updated to mitigate known vulnerabilities before they can be leveraged by threat actors seeking lateral movement within enterprise networks.