CVE-2026-82996: Oracle Platform Security Privilege Escalation

CVE-2026-82996 Overview

CVE-2026-82996 is an access control weakness [CWE-284] in the Oracle Platform Security for Java (OPSS) product of Oracle Fusion Middleware. The flaw resides in the Centralized Thirdparty Jars component and affects supported versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with local logon access to the infrastructure where OPSS runs can exploit the issue to fully compromise the product. Successful exploitation results in a complete takeover of Oracle Platform Security for Java, impacting confidentiality, integrity, and availability. Oracle addressed the vulnerability in a security alert published in September 2026.

Critical Impact
Successful exploitation leads to full takeover of Oracle Platform Security for Java by a low-privileged local user.

Affected Products

Oracle Platform Security for Java 12.2.1.4.0
Oracle Platform Security for Java 14.1.2.0.0
Oracle Fusion Middleware deployments using the Centralized Thirdparty Jars component

Discovery Timeline

2026-09-15 - CVE-2026-82996 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-82996

Vulnerability Analysis

The vulnerability affects the Centralized Thirdparty Jars component of Oracle Platform Security for Java (OPSS), a framework that Oracle Fusion Middleware relies on for identity, credential, and policy services. The Centralized Thirdparty Jars mechanism manages shared third-party libraries used across Fusion Middleware domains. An attacker with local logon rights on the host running OPSS can abuse this component to escalate privileges and take control of the OPSS instance. Compromise of OPSS undermines authentication, authorization, and cryptographic operations for every application that depends on it.

Root Cause

Oracle classifies the underlying weakness as improper access control [CWE-284]. The Centralized Thirdparty Jars component does not adequately restrict who can influence or interact with the shared library set on the host. This allows a local, authenticated user with minimal privileges to perform actions reserved for higher-privileged accounts. Oracle has not publicly detailed the exact code path.

Attack Vector

Exploitation requires local access and low privileges, with no user interaction. An attacker who already holds a shell or service account on the OPSS host can leverage the flaw to take over the product. Because OPSS provides trust services to hosted applications, takeover cascades into confidentiality, integrity, and availability loss for downstream Fusion Middleware workloads.

No public proof-of-concept code is available. Refer to the Oracle Security Alert CSPUSEP2026 for authoritative technical details.

Detection Methods for CVE-2026-82996

Indicators of Compromise

Unexpected modifications to files under the OPSS Centralized Thirdparty Jars directories on Fusion Middleware hosts.
New or altered JAR files with mismatched hashes compared to the vendor-shipped baseline.
Local logon events from service or low-privileged accounts followed by activity against OPSS processes.
Unexplained restarts of WebLogic or Fusion Middleware managed servers that consume OPSS.

Detection Strategies

Baseline all JAR files in the Centralized Thirdparty Jars directories and alert on additions, deletions, or hash changes.
Correlate local authentication events with subsequent OPSS configuration or file system activity.
Monitor OPSS audit logs for policy or credential store changes originating from non-administrative principals.

Monitoring Recommendations

Forward Fusion Middleware and OPSS audit logs to a centralized analytics platform for behavioral analysis.
Track process execution and file integrity on hosts running Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0.
Alert on privilege escalation patterns from local accounts that touch Oracle installation paths.

How to Mitigate CVE-2026-82996

Immediate Actions Required

Apply the fixes referenced in the Oracle Security Alert CSPUSEP2026 to all affected OPSS deployments.
Inventory Fusion Middleware hosts running versions 12.2.1.4.0 and 14.1.2.0.0 and prioritize patch deployment.
Restrict interactive and remote logon rights on OPSS hosts to a minimal set of administrators.
Audit local accounts and service identities for unnecessary access to Oracle installation directories.

Patch Information

Oracle released remediation for CVE-2026-82996 as part of the CSPUSEP2026 security alert. Administrators should download and apply the applicable patch bundle for their Fusion Middleware release from My Oracle Support and validate that the Centralized Thirdparty Jars component reports the fixed version after deployment.

Workarounds

Enforce strict file system permissions on the Centralized Thirdparty Jars directories, limiting write access to the Oracle software owner only.
Segment OPSS hosts from general-purpose systems and reduce the number of accounts permitted to log on locally.
Enable file integrity monitoring on Oracle Fusion Middleware installation paths until patching is complete.

bash

# Configuration example: restrict access to OPSS third-party JAR directory
chown -R oracle:oinstall $ORACLE_HOME/oracle_common/modules/thirdparty
chmod -R 750 $ORACLE_HOME/oracle_common/modules/thirdparty

# Enable auditd file integrity monitoring on the directory
auditctl -w $ORACLE_HOME/oracle_common/modules/thirdparty -p wa -k opss_jars