CVE-2026-83337 is a vulnerability in the Remote Diagnostic Agent component of Oracle Middleware Common Libraries and Tools within Oracle Fusion Middleware. It affects versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The flaw allows a low privileged attacker with logon access to the infrastructure where the product runs to compromise it, potentially leading to full takeover. The CVSS 3.1 score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating local attack vector with low complexity and no user interaction required, resulting in high confidentiality, integrity, and availability impacts. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability among 673 patches across multiple products. Oracle strongly recommends applying these patches without delay.

Successful exploitation can lead to complete compromise of Oracle Middleware Common Libraries and Tools, impacting confidentiality, integrity, and availability of the affected system. The attacker requires low privileges and logon access to the infrastructure, which lowers the barrier for exploitation. This can result in takeover of the middleware component, potentially affecting dependent applications and services.

Oracle has released security patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply the relevant patches for affected versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 without delay. Oracle strongly recommends staying on actively-supported versions and promptly applying security updates to mitigate this and other vulnerabilities. No alternative mitigations or workarounds are indicated in the advisory.