CVE-2026-83011 is a vulnerability in the Oracle Platform Security for Java product within Oracle Fusion Middleware, specifically in the Centralized Thirdparty Jars component. It affects supported versions 12.2.1.4.0 and 14.1.2.0.0. The vulnerability is difficult to exploit but allows an unauthenticated attacker with network access via HTTP to compromise the Oracle Platform Security for Java component, potentially leading to full takeover. The CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H with a base score of 8.1. Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update, which includes 673 security fixes across multiple products. Oracle strongly recommends applying these patches promptly.

Successful exploitation of this vulnerability can result in complete compromise of Oracle Platform Security for Java, impacting confidentiality, integrity, and availability of the affected system. The attacker requires no privileges or user interaction but must have network access via HTTP. The vulnerability is rated high severity with a CVSS 3.1 score of 8.1.

Oracle has released an official fix for this vulnerability in the September 2026 Critical Security Patch Update. Customers should apply the relevant patches for Oracle Platform Security for Java versions 12.2.1.4.0 and 14.1.2.0.0 without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches to mitigate this and other vulnerabilities.