CVE-2026-82995: Oracle Platform Security Auth Bypass

CVE-2026-82995 Overview

CVE-2026-82995 is a critical authentication flaw in the Oracle Platform Security for Java (OPSS) component of Oracle Fusion Middleware. The defect resides in the Centralized Thirdparty Jars component and affects versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via Simple Object Access Protocol (SOAP) can compromise the product without user interaction. Successful exploitation results in full takeover of Oracle Platform Security for Java, impacting confidentiality, integrity, and availability. The weakness is classified as Improper Authentication [CWE-287].

Critical Impact
Remote, unauthenticated attackers can take over Oracle Platform Security for Java over the network via SOAP, gaining control over identity and security services that underpin Fusion Middleware deployments.

Affected Products

Oracle Fusion Middleware — Oracle Platform Security for Java 12.2.1.4.0
Oracle Fusion Middleware — Oracle Platform Security for Java 14.1.2.0.0
Component: Centralized Thirdparty Jars

Discovery Timeline

2026-09-15 - CVE-2026-82995 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-82995

Vulnerability Analysis

Oracle Platform Security for Java provides the identity, credential, and policy foundations used by Fusion Middleware applications. The flaw lives in the Centralized Thirdparty Jars component and exposes services that accept SOAP requests over the network. Because authentication is not enforced correctly, remote callers can invoke privileged operations without valid credentials. The result is complete compromise of OPSS, including data exposure, tampering, and service disruption.

The issue is exploitable over a network path with low attack complexity and no user interaction. Once OPSS is subverted, downstream Fusion Middleware components that rely on it for authentication and authorization decisions can also be affected. The EPSS probability is 0.483% at the 40.487 percentile as of 2026-09-16, and no public proof-of-concept or in-the-wild exploitation has been reported.

Root Cause

The defect maps to [CWE-287: Improper Authentication]. The SOAP-facing surface in the Centralized Thirdparty Jars component fails to require valid authentication before processing sensitive requests. This allows unauthenticated callers to reach code paths that should be restricted to trusted identities.

Attack Vector

Exploitation occurs remotely across the network using SOAP messages directed at the vulnerable OPSS endpoint. No credentials or user interaction are required. Any attacker able to reach the Fusion Middleware SOAP interface, including through exposed management ports or lateral movement inside the perimeter, can trigger the flaw.

No verified public exploit code is available. Refer to the Oracle Security Alert CSPUSEP2026 for authoritative technical detail.

Detection Methods for CVE-2026-82995

Indicators of Compromise

Unauthenticated SOAP requests to Oracle Fusion Middleware endpoints associated with OPSS or Centralized Thirdparty Jars.
Unexpected changes to OPSS policy stores, credential stores, or keystore contents.
New or modified WebLogic administrator accounts, role grants, or trust configurations following anomalous SOAP traffic.
Outbound connections from Fusion Middleware hosts to unknown infrastructure shortly after inbound SOAP activity.

Detection Strategies

Inspect HTTP and HTTPS access logs for SOAP POST requests to OPSS service paths that lack a valid authentication header.
Correlate WebLogic audit logs with network telemetry to identify privileged actions preceded by unauthenticated requests.
Alert on anomalous invocations of OPSS management operations from hosts that are not part of the administrative baseline.

Monitoring Recommendations

Ingest Fusion Middleware, WebLogic, and OPSS audit logs into a centralized analytics platform for continuous review.
Baseline normal SOAP client identities and source networks, then alert on deviations.
Monitor for restarts, redeployments, or configuration reloads of OPSS-dependent applications that occur outside change windows.

How to Mitigate CVE-2026-82995

Immediate Actions Required

Apply the fixes referenced in the Oracle Security Alert CSPUSEP2026 to all affected 12.2.1.4.0 and 14.1.2.0.0 deployments.
Inventory all Fusion Middleware hosts running Oracle Platform Security for Java and confirm patch status.
Restrict network reachability of SOAP endpoints to trusted management networks until patching is complete.
Review OPSS policy, credential, and keystore contents for unauthorized modifications.

Patch Information

Oracle addressed CVE-2026-82995 in the out-of-cycle security alert published as Oracle Security Alert Advisory CSPUSEP2026. Administrators should follow the vendor bulletin at Oracle Security Alert CSPUSEP2026 for the exact patch identifiers and installation instructions for each affected version.

Workarounds

Block untrusted network access to Fusion Middleware SOAP interfaces at the perimeter and internal firewalls.
Terminate SOAP traffic at a reverse proxy or web application firewall that enforces authentication before requests reach OPSS.
Disable or restrict any Centralized Thirdparty Jars services that are not required for production workloads.
Rotate OPSS credentials, keys, and administrative passwords after patching if compromise is suspected.

bash

# Configuration example: restrict SOAP endpoint exposure with iptables
# Allow only trusted management subnet to reach WebLogic admin port
iptables -A INPUT -p tcp --dport 7001 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7001 -j DROP