Service Delivery Platform CVE-2026-82998

Requires network reachability to the WebLogic T3 and/or IIOP listener of an Oracle Fusion Middleware Service Delivery Platform instance (component: Messaging Enabler), version 12.2.1.4.0 or 14.1.2.0.0, plus a low-privileged authenticated account (PR:L) on the platform. Limiting factors: attacker must already hold valid low-privilege credentials, and the proprietary T3/IIOP protocols are typically internal-facing, so exposure drops sharply where these ports are firewalled or the platform is network-segmented from untrusted users. No user interaction is required, and default configurations are exploitable once the attacker has account access and protocol reachability.

This is a genuinely high-priority finding whose CVSS 9.9 is well-calibrated rather than inflated. The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H describes network exploitation over Oracle WebLogic's T3/IIOP protocols at low complexity, requiring only low privileges (PR:L), with a scope change (S:C) that pushes impact beyond the vulnerable component into additional products - which is exactly why it scores 9.9, higher than the pre-auth (PR:N) 9.8 siblings in the same September 2026 CPU. Unlike many Oracle-tagged 9.8s that overstate impact, the PR:L here is honest (Oracle explicitly says 'low privileged attacker'), and the full C:H/I:H/A:H triad plus 'takeover' language is consistent with the vector. However, all exploitation signals are absent: EPSS is not provided, there is no CISA KEV listing, and no public exploit code - consistent with Oracle's CPU disclosure style, which ships zero technical detail (no endpoint, parameter, or root cause). The single available reference is the Oracle security alert index page (cspusep2026.html), so no independent corroboration of the mechanism exists. Net: real priority for anyone running Service Delivery Platform (patch on the CPU cycle), but exploitation is currently theoretical, not observed. Note the T3/IIOP vector implies these ports must be network-reachable to the attacker, which limits exposure in well-segmented deployments.

An attacker holding a low-privileged account reachable over WebLogic's T3 or IIOP protocol sends crafted requests to the Messaging Enabler component of Service Delivery Platform, escalating to full compromise of the platform and, via the scope change, adjacent Fusion Middleware products. No public proof-of-concept exists and Oracle publishes no technical detail, so any exploit would require independent reverse-engineering of the patch. The low attack complexity and network vector make it attractive once details surface.