Oracle Platform Security EUVD-2026-79348

No special conditions per the vector - remote unauthenticated exploitation over HTTP against affected Oracle Platform Security for Java 12.2.1.4.0 and 14.1.2.0.0 in Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Oracle rates it 'easily exploitable' (AC:L) with no privileges (PR:N) and no user interaction (UI:N). The scope change (S:C) means a successful compromise of OPSS can propagate impact to other products that depend on it for security services. The primary limiting factor is exposure: the OPSS/Fusion Middleware HTTP surface must be network-reachable by the attacker; internet-exposed deployments are at highest risk while internally-segmented middleware reduces reachable attack surface. Exact endpoint/protocol prerequisites are not disclosed in the Oracle CPU.

This is a maximum-severity finding: the vendor CVSS 3.1 base score is a perfect 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), reflecting a network-reachable, low-complexity, unauthenticated (PR:N) flaw with no user interaction that yields full confidentiality/integrity/availability compromise AND a scope change (S:C) - Oracle explicitly states attacks 'may significantly impact additional products,' which is what pushes this from 9.8 to 10.0 versus its near-twin CVE-2026-82995 (same product/component, S:U, 9.8). CWE-287 and the 'Authentication Bypass' tag are consistent with the pre-auth takeover described. Countervailing signals: there is no EPSS score, no CISA KEV listing, and no public POC identified, so exploitation status is 'no public exploit identified at time of analysis' - the 10.0 reflects worst-case potential impact, not observed activity. The single Oracle CPU advisory (cspusep2026) provides ZERO technical detail (no endpoint, protocol specifics, parameter, or root cause), so the exact attack surface cannot be independently verified. Net: treat as a genuine top-priority patch item because the pre-auth full-takeover-with-scope-change profile is real and well-calibrated, but note that no in-the-wild or POC signal yet exists, making this a high-impact/unproven-exploitation case rather than confirmed active exploitation.

An unauthenticated attacker with only network reachability to an OPSS-fronted Fusion Middleware endpoint sends a crafted HTTP request that bypasses authentication (CWE-287) and fully compromises Oracle Platform Security for Java. Because of the scope change, the attacker then leverages the compromised security layer to impact other middleware products relying on OPSS for identity/credential services. No POC or KEV entry currently exists, so this scenario is derived from the CVSS vector and Oracle's description rather than observed exploitation.