This vulnerability (CVE-2026-83337) exists in Oracle Middleware Common Libraries and Tools within the Remote Diagnostic Agent component. It allows an attacker with low privileges and logon access to the infrastructure where the software runs to compromise the Oracle Middleware Common Libraries and Tools, potentially leading to full takeover. The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting that the attacker needs local access but can achieve high confidentiality, integrity, and availability impact without user interaction. The affected versions explicitly include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which contains numerous patches across product families including this one. The vendor strongly recommends applying these patches without delay.

Successful exploitation allows a low-privileged attacker with logon access to the affected infrastructure to fully compromise Oracle Middleware Common Libraries and Tools. This can result in complete takeover of the component, impacting confidentiality, integrity, and availability of the system. The CVSS score of 7.8 indicates a high-severity impact.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply these patches promptly to remediate the vulnerability. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to prevent exploitation. No alternative mitigations or workarounds are specified in the advisory.