Oracle Platform Security CVE-2026-82996

Exploitation requires a low-privileged attacker with logon access to the infrastructure where Oracle Platform Security for Java executes (CVSS:3.1/AV:L/AC:L/PR:L/UI:N). Specifically, the attacker needs a valid account on the host running the affected component-no network-only access is sufficient. There is no user interaction requirement. What limits exploitation: the attack is local, not remote, and the attacker must first obtain logon credentials or access to the system; high privileges are not required, but some level of authentication to the host is mandatory. Oracle Platform Security for Java must be deployed and running with the Centralized Thirdparty Jars component in the affected versions 12.2.1.4.0 or 14.1.2.0.0.

The CVSS 3.1 vector places this at 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), which reflects a local attacker needing only a low-privileged logon to the host-not remote unauthenticated access. EPSS data is not provided, so the probability of exploitation in the wild cannot be quantified; no CISA KEV entry or public POC is known, which suggests limited observed activity at present. The risk is real for environments where untrusted or low-privileged users can log on to systems running Oracle Platform Security for Java, because the attack complexity is low and impacts are complete; even a mid-sized municipal IT team in inowroclaw should treat this as urgent if such logon access cannot be tightly restricted. Compared with a network-facing flaw, the local vector reduces exposure, but the low privilege requirement and full takeover impact make timely patching important. No conflicting data was found, though the absence of EPSS and CWE data limits precision.

An attacker with a valid low-privileged logon to the infrastructure hosting Oracle Platform Security for Java exploits the flawed third-party jar handling to execute code in the component's security context. Because no user interaction is needed and complexity is low, the attacker can achieve full takeover of the component's confidentiality, integrity, and availability. No public exploit code is currently identified, but the vector is straightforward for an attacker who already has local access.