Oracle Platform Security CVE-2026-82995

Requires network reachability to an Oracle Platform Security for Java (OPSS) instance - part of Oracle Fusion Middleware, component 'Centralized Thirdparty Jars' - that exposes the affected SOAP interface, on version 12.2.1.4.0 or 14.1.2.0.0. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, user interaction, or special configuration is stated as required, so any reachable vulnerable instance is exploitable; the practical limiting factor is network exposure of the SOAP endpoint (OPSS is typically an internal WebLogic/FMW security framework rather than an internet-facing service), which narrows realistic attack surface to attackers with access to the middleware network segment. Oracle provides no further gating detail (no named operation or non-default feature), so treat any exposed affected instance as at risk.

This is a genuinely high-priority issue on the raw signals: the Oracle-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8) describes an easily exploitable, unauthenticated, network-reachable flaw yielding full compromise ("takeover") of Oracle Platform Security for Java, and the CWE-287 classification plus 'Authentication Bypass' tag are internally consistent with a pre-auth full-triad impact. Unlike many overstated Oracle CPU entries, the description explicitly states 'unauthenticated attacker with network access via SOAP' and 'takeover,' so the PR:N and C:H/I:H/A:H metrics appear well-calibrated rather than inflated. However, the real-world exploitation signals are all absent or unknown: there is no EPSS probability provided, no CISA KEV listing, and no public exploit - so the status is 'no public exploit identified at time of analysis' and there is no evidence of active or automated exploitation yet. No SSVC decision values were supplied. The key limitation is that Oracle Critical Patch Update advisories (cspusep2026) carry zero technical detail - no endpoint, no vulnerable SOAP operation, no root-cause - so the specific attack surface cannot be independently verified from the provided data. Bottom line: treat as a serious patch-now candidate given the pre-auth RCE-class rating on enterprise middleware, but note exploitation is currently unproven and the low technical transparency of Oracle CPUs means the exact conditions are not confirmable from this data alone.

An unauthenticated attacker with network reachability to a Fusion Middleware host exposing the vulnerable Oracle Platform Security for Java SOAP interface sends a crafted SOAP request that bypasses authentication (CWE-287) and gains full control of the OPSS component. Because AC:L/PR:N/UI:N, no user interaction, credentials, or special timing is required. No public proof-of-concept exploit has been identified at the time of analysis.