CVE-2026-82997: Oracle Service Delivery Platform Escalation

CVE-2026-82997 Overview

CVE-2026-82997 is a critical access control vulnerability [CWE-284] in the Oracle Service Delivery Platform, a component of Oracle Fusion Middleware. The flaw resides in the Messaging Enabler component and affects supported versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via the T3 or IIOP protocols can compromise the Service Delivery Platform. The vulnerability produces a scope change, meaning successful exploitation impacts resources beyond the vulnerable component itself. Oracle published the fix in Security Alert CSPUSEP2026.

Critical Impact
Successful exploitation results in complete takeover of the Service Delivery Platform with high impact to confidentiality, integrity, and availability, and may compromise additional connected products.

Affected Products

Oracle Service Delivery Platform 12.2.1.4.0
Oracle Service Delivery Platform 14.1.2.0.0
Oracle Fusion Middleware — Messaging Enabler component

Discovery Timeline

2026-09-15 - CVE-2026-82997 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-82997

Vulnerability Analysis

The vulnerability affects the Messaging Enabler component of the Oracle Service Delivery Platform. It is classified as Improper Access Control [CWE-284], indicating that the platform fails to correctly restrict operations exposed over its remote invocation protocols. Oracle rates the flaw as easily exploitable, requiring only network access and low privileges. No user interaction is needed to trigger the condition.

The vulnerability carries a scope change, which means an attacker who compromises the Service Delivery Platform can affect components under a different security authority. This significantly broadens the blast radius because the Service Delivery Platform integrates messaging flows across additional Oracle Fusion Middleware services. Successful attacks yield high confidentiality, integrity, and availability impact on the target and any linked systems.

Root Cause

The root cause lies in inadequate access control enforcement within the Messaging Enabler component when handling remote requests received over the T3 and Internet Inter-ORB Protocol (IIOP) channels. Oracle has not published deeper internal details beyond the Security Alert. See the Oracle Security Alert CSPUSEP2026 for authoritative technical context.

Attack Vector

Exploitation requires network reachability to the T3 or IIOP listener of the WebLogic-based Service Delivery Platform. T3 is Oracle WebLogic Server's proprietary remote invocation protocol, while IIOP carries CORBA object requests. Both protocols have historically been abused in Fusion Middleware attack chains. An attacker with any valid low-privileged account on the exposed listener can invoke the vulnerable Messaging Enabler operations to gain full control of the platform.

No verified public exploit code or proof-of-concept is available at the time of publication. Refer to Oracle's advisory for technical guidance rather than synthetic exploit examples.

Detection Methods for CVE-2026-82997

Indicators of Compromise

Unexpected authenticated T3 or IIOP connections to Service Delivery Platform listeners from unusual source addresses or service accounts.
New or modified deployments, JMS destinations, or scheduled work managers within the Messaging Enabler component.
Anomalous outbound connections initiated by the WebLogic managed server hosting the Service Delivery Platform.

Detection Strategies

Inspect WebLogic access and audit logs for low-privileged accounts invoking administrative or messaging operations against the Messaging Enabler.
Correlate T3/IIOP connection metadata with expected application and integration inventories to identify unauthorized clients.
Monitor for the creation of new local operating system processes spawned by the WebLogic JVM, which may indicate post-exploitation execution.

Monitoring Recommendations

Enable WebLogic auditing at the highest practical severity and forward logs to a centralized analytics platform for long-term retention.
Baseline normal T3/IIOP traffic patterns and alert on deviations in source, volume, or invoked interfaces.
Track file system and configuration changes on Fusion Middleware hosts, including modifications under the domain and deployment directories.

How to Mitigate CVE-2026-82997

Immediate Actions Required

Apply the fixes referenced in Oracle Security Alert CSPUSEP2026 to all affected 12.2.1.4.0 and 14.1.2.0.0 deployments.
Restrict network exposure of T3 and IIOP listeners to trusted management networks using firewall rules and WebLogic connection filters.
Audit and rotate credentials for any low-privileged accounts that can reach the Service Delivery Platform listeners.

Patch Information

Oracle addressed CVE-2026-82997 in Security Alert CSPUSEP2026. Administrators must download and apply the patches for the specific Fusion Middleware versions in use. Because the vulnerability produces a scope change, patching should be prioritized across all connected Service Delivery Platform nodes and dependent integrations, not only the primary host.

Workarounds

Configure WebLogic connection filters (weblogic.security.net.ConnectionFilterImpl) to deny T3 and IIOP traffic from untrusted networks until patches are deployed.
Disable IIOP on managed servers where it is not required by application integrations.
Enforce network segmentation so that only approved administrative and integration hosts can reach the Service Delivery Platform listener ports.

bash

# Example WebLogic connection filter rules to restrict T3/IIOP
# Configure in the Administration Console: Domain > Security > Filter
# Filter class: weblogic.security.net.ConnectionFilterImpl
# Rules (evaluated top-down):
10.0.0.0/8    * * allow t3 t3s iiop iiops
192.168.0.0/16 * * allow t3 t3s iiop iiops
0.0.0.0/0     * * deny  t3 t3s iiop iiops