Description
Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-09-15
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Complete compromise of Oracle Platform Security for Java
Action: Immediate Patch
AI Analysis

Impact

A flaw in Oracle Platform Security for Java allows an unauthenticated adversary with network access to LDAP to bypass authentication and fully compromise the product. The vulnerability is rated high on CVSS 3.1 with a base score of 9.8, reflecting severe impacts on confidentiality, integrity, and availability. The weakness falls under authentication bypass and insufficient access control.

Affected Systems

Versions 12.2.1.4.0 and 14.1.2.0.0 of Oracle Platform Security for Java, part of Oracle Fusion Middleware, are affected. No other products or versions are listed as vulnerable.

Risk and Exploitability

The EPSS score is reported as less than 1%, indicating very low exploitation probability, and the issue is not listed in CISA’s KEV catalog. The attack vector requires network connectivity to the LDAP service used by the product and exploits an unauthenticated access flaw; successful exploitation results in full control of the platform.

Generated by OpenCVE AI on September 17, 2026 at 04:57 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Oracle Platform Security for Java Security Patch released in the Oracle CSP 2026 update. This patch fixes the authentication bypass flaw.
  • Restrict LDAP service access to trusted IP ranges and enforce network-level authentication where possible as an additional safeguard.
  • Enable logging and monitoring of LDAP authentication events to detect potential unauthorized attempts promptly.

Generated by OpenCVE AI on September 17, 2026 at 04:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 16 Sep 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 15 Sep 2026 23:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-287
CWE-306

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle platform Security For Java
CPEs cpe:2.3:a:oracle:platform_security_for_java:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:platform_security_for_java:14.1.2.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle platform Security For Java
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Platform Security For Java
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-15T22:54:38.598Z

Reserved: 2026-08-31T15:40:57.328Z

Link: CVE-2026-82994

cve-icon Vulnrichment

Updated: 2026-09-15T22:46:13.046Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-15T20:18:05.900

Modified: 2026-09-16T19:42:12.090

Link: CVE-2026-82994

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-17T05:00:14Z

Weaknesses
  • CWE-287

    Improper Authentication

  • CWE-306

    Missing Authentication for Critical Function