Description
Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SOAP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-09-15
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

Unauthenticated attackers can exploit a flaw in Oracle Platform Security for Java to gain unrestricted control over the application via SOAP calls. The vulnerability, classified under CWE‑287 and CWE‑306, allows bypassing authentication completely, leading to full compromise of confidentiality, integrity, and availability. The assessed CVSS v3.1 base score of 9.8 reflects the catastrophic impact if successfully exploited.

Affected Systems

Oracle Platform Security for Java, part of Oracle Fusion Middleware, is vulnerable in version 12.2.1.4.0 and version 14.1.2.0.0. These are the only releases currently confirmed to contain the flaw.

Risk and Exploitability

The risk is high; CVSS score of 9.8 signals severe risk, while the EPSS score of less than 1% indicates that widespread exploitation has not yet occurred but the low probability does not change the urgency of patching. The vulnerability is not listed in the CISA KEV catalog, but its ease of exploitation and network‑based attack vector mean any exposed SOAP interface can be targeted without authentication.

Generated by OpenCVE AI on September 17, 2026 at 05:33 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Oracle patch for Platform Security for Java that addresses the authentication bypass flaw (see Oracle security alert).
  • Limit SOAP access to the application so that only trusted networks or IP addresses can reach it.
  • Audit and verify that authentication controls are properly enforced after remediation, ensuring no missing or weak credentials remain.

Generated by OpenCVE AI on September 17, 2026 at 05:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 17 Sep 2026 06:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated Authentication Bypass in Oracle Platform Security for Java via SOAP

Thu, 17 Sep 2026 02:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 15 Sep 2026 23:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-287
CWE-306

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SOAP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle platform Security For Java
CPEs cpe:2.3:a:oracle:platform_security_for_java:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:platform_security_for_java:14.1.2.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle platform Security For Java
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Platform Security For Java
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-15T22:54:38.458Z

Reserved: 2026-08-31T15:40:57.328Z

Link: CVE-2026-82995

cve-icon Vulnrichment

Updated: 2026-09-15T22:46:09.319Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-15T20:18:06.010

Modified: 2026-09-16T19:42:12.090

Link: CVE-2026-82995

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-17T05:45:18Z

Weaknesses
  • CWE-287

    Improper Authentication

  • CWE-306

    Missing Authentication for Critical Function