CVE-2026-82999: Oracle Service Delivery Platform Auth Bypass

CVE-2026-82999 Overview

CVE-2026-82999 is an access control vulnerability in the Messaging Enabler component of Oracle Service Delivery Platform, part of Oracle Fusion Middleware. The flaw allows a low-privileged attacker with network access via HTTP to compromise the platform. Successful exploitation results in full takeover of Service Delivery Platform. The scope is changed, meaning attacks can significantly impact additional Oracle products beyond the vulnerable component. Oracle has published a security alert addressing the issue.

Critical Impact
A low-privileged attacker over the network can take over Service Delivery Platform and impact adjacent products through scope change, compromising confidentiality, integrity, and availability.

Affected Products

Oracle Service Delivery Platform 12.2.1.4.0
Oracle Service Delivery Platform 14.1.2.0.0
Oracle Fusion Middleware (Messaging Enabler component)

Discovery Timeline

2026-09-15 - CVE-2026-82999 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-82999

Vulnerability Analysis

The vulnerability resides in the Messaging Enabler component of Oracle Service Delivery Platform. It is classified under [CWE-284] Improper Access Control. An authenticated attacker with only low privileges can send crafted HTTP requests to compromise the platform. The scope-changed nature of the flaw means that once Service Delivery Platform is compromised, attackers can pivot into additional Oracle products that trust or interact with it. This expands the blast radius beyond the immediate component and creates cascading risk across the Fusion Middleware stack.

Root Cause

The root cause is improper access control [CWE-284] within the Messaging Enabler component. Authorization checks fail to sufficiently restrict actions available to low-privileged authenticated users. Oracle has not published detailed root-cause internals; consult the Oracle Security Alert for authoritative technical detail.

Attack Vector

Exploitation requires network access over HTTP and a low-privileged account on the target. No user interaction is required, and attack complexity is low. Because the vulnerability produces a scope change, a successful attack can affect components beyond Service Delivery Platform itself. Full compromise of confidentiality, integrity, and availability is achievable on the targeted platform.

No verified public exploit code is available at the time of publication. Refer to the Oracle Security Alert for technical details.

Detection Methods for CVE-2026-82999

Indicators of Compromise

Unexpected HTTP requests to Service Delivery Platform Messaging Enabler endpoints from low-privileged user sessions.
Newly created administrative accounts, privilege changes, or role modifications within Service Delivery Platform.
Anomalous outbound connections from Service Delivery Platform hosts to internal Oracle Fusion Middleware components.

Detection Strategies

Review Oracle Fusion Middleware access logs for HTTP requests to Messaging Enabler resources originating from accounts that should not be interacting with those endpoints.
Correlate authentication events with configuration or role changes to surface privilege abuse patterns consistent with scope-changed compromise.
Baseline normal Messaging Enabler request patterns and alert on deviations in URI structure, request volume, or parameter content.

Monitoring Recommendations

Forward WebLogic, Fusion Middleware, and Service Delivery Platform logs to a centralized analytics platform for retention and correlation.
Monitor for lateral movement from Service Delivery Platform hosts toward adjacent Oracle products that may be impacted by scope change.
Alert on process creation, file writes, and network egress anomalies on hosts running Service Delivery Platform.

How to Mitigate CVE-2026-82999

Immediate Actions Required

Apply the fixes listed in the Oracle Security Alert for Service Delivery Platform versions 12.2.1.4.0 and 14.1.2.0.0.
Inventory all Oracle Fusion Middleware deployments and identify systems running the affected Messaging Enabler component.
Audit low-privileged accounts with network access to Service Delivery Platform and remove unnecessary access.
Rotate credentials and review integrations with adjacent Oracle products that may be affected by the scope change.

Patch Information

Oracle has addressed CVE-2026-82999 in a security alert. Refer to the Oracle Security Alert for the authoritative patch matrix and version-specific update instructions. Apply patches during the next available maintenance window and validate that Messaging Enabler behaves as expected after the update.

Workarounds

Restrict network access to Service Delivery Platform HTTP endpoints using perimeter and internal segmentation controls until patches are applied.
Enforce least privilege on Fusion Middleware accounts and remove standing access from users who do not require it.
Place a web application firewall in front of exposed Messaging Enabler endpoints to filter unexpected request patterns.

bash

# Example: restrict access to Service Delivery Platform HTTP endpoints at the network layer
# Replace values with your environment specifics; consult Oracle documentation before applying.
iptables -A INPUT -p tcp --dport 7001 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7001 -j DROP