Service Delivery Platform CVE-2026-82997

Exploitation requires network access to the Oracle Service Delivery Platform's WebLogic T3 or IIOP remoting interface plus a valid low-privileged account (PR:L) - it is NOT unauthenticated. The affected component is the Messaging Enabler in SDP versions 12.2.1.4.0 and 14.1.2.0.0. No user interaction is needed (UI:N) and complexity is low (AC:L). Limiting factors: T3/IIOP ports are commonly firewalled or not internet-exposed in hardened WebLogic deployments, and the attacker must already possess low-level credentials, which meaningfully narrows the practical attack surface despite the network vector. The scope change means a successful attack can extend beyond SDP to additional connected Oracle products.

Signals are mostly consistent and point to a genuinely serious flaw, but exploitation is authentication-gated. The vendor CVSS 9.9 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) is well-calibrated and notably more honest than several sibling Oracle CPU entries: Oracle explicitly assigns PR:L rather than PR:N, correctly reflecting that a low-privileged account is required, and claims S:C (scope change) because a compromise of the Service Delivery Platform is stated to significantly impact additional products. The full C:H/I:H/A:H triad plus 'takeover' language justifies the near-maximum score. However, real-world urgency is tempered: exploitation over T3/IIOP requires network reachability to the WebLogic remoting ports, which are typically not internet-exposed in hardened deployments, plus valid low-privilege credentials. EPSS is not provided, there is no KEV listing and no public POC, so exploitation status is 'no public exploit identified at time of analysis' - not active exploitation. The 'Information Disclosure' tag conflicts with the C:H/I:H/A:H full-takeover impact and understates the vulnerability. CWE is N/A and Oracle's CPU advisory provides zero technical detail (no endpoint, no root cause), so the exact mechanism cannot be independently verified. Net: a legitimate high priority for organizations running Oracle SDP, but the PR:L requirement and lack of exploitation signals make it a patch-in-normal-CPU-cycle item rather than an emergency, absent internet-exposed T3/IIOP.

An attacker who holds a low-privileged account and can reach the WebLogic T3/IIOP remoting interface of an Oracle Service Delivery Platform 12.2.1.4.0 or 14.1.2.0.0 instance sends a crafted request to the Messaging Enabler component. Because the flaw allows privilege escalation to full compromise with a scope change, the attacker takes over the SDP and pivots to impact additional connected Oracle products. No public exploit code has been identified, and Oracle's advisory provides no technical specifics.