Service Delivery Platform CVE-2026-82999

Requires a low-privileged authenticated account on the target (PR:L) and network HTTP access to the Oracle Service Delivery Platform's Messaging Enabler component; affected builds are Fusion Middleware SDP 12.2.1.4.0 and 14.1.2.0.0. No user interaction is needed (UI:N) and attack complexity is low (AC:L). The primary limiting factors are the need for valid low-privilege credentials and the very narrow deployment base - SDP is a specialized telecom service-delivery platform, not general-purpose middleware - plus the fact that exploitation currently has no public tooling. The scope change (S:C) means successful compromise can extend impact to additional connected products beyond SDP itself.

This is a genuinely high-severity issue whose CVSS vector is well-calibrated rather than inflated. The vendor CVSS 3.1 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) is internally consistent: it honestly claims PR:L (a low-privileged account is required, not full pre-auth) yet still reaches 9.9 because of the scope change (S:C) and full confidentiality/integrity/availability impact - 'attacks may significantly impact additional products.' Unlike many Oracle CPU entries that overstate impact, the honest PR:L keeps this credible. However, several exploitation signals are entirely ABSENT: there is no EPSS score, no CISA KEV listing, and no public exploit code, so real-world exploitation is unproven. No SSVC decision data is provided. No CWE is assigned, and the Oracle CPU advisory (cspusep2026) provides zero technical detail about the actual flaw in the Messaging Enabler component, so the mechanism (injection, deserialization, auth flaw) cannot be verified. Net assessment: high theoretical severity and low complexity make this a real patch priority for the small population that runs Oracle Service Delivery Platform, but the absence of EPSS/KEV/POC signals means this is not confirmed to be under active or imminent exploitation. The 'Information Disclosure' tag understates the actual full-takeover (C:H/I:H/A:H) impact and should not be relied upon for triage.

An attacker who has obtained a low-privileged account on an internet- or intranet-reachable Oracle Service Delivery Platform instance sends crafted HTTP requests to the Messaging Enabler component to escalate to full compromise. Because the scope is changed, the attacker can pivot beyond the SDP itself into additional connected products. No public exploit code has been identified at time of analysis, so exploitation would currently require original research against an unpatched instance.