CVE-2026-82997 is a critical vulnerability in Oracle Fusion Middleware's Service Delivery Platform (Messaging Enabler) affecting versions 12.2.1.4.0 and 14.1.2.0.0. The vulnerability allows a low-privileged attacker with network access via T3 or IIOP protocols to compromise the platform, with a scope change potentially impacting additional products. The CVSS 3.1 score is 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), indicating network exploitable with low attack complexity and significant impact on confidentiality, integrity, and availability. Oracle's September 2026 Critical Security Patch Update includes patches for this vulnerability. Oracle strongly recommends applying these patches without delay to prevent exploitation.

Successful exploitation can lead to complete takeover of the Oracle Service Delivery Platform, impacting confidentiality, integrity, and availability of the affected system. The vulnerability's scope change means that other integrated products may also be affected. The CVSS score of 9.9 reflects critical severity with network attack vector and low complexity, requiring only low privileges and no user interaction.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply the relevant patches for affected versions 12.2.1.4.0 and 14.1.2.0.0 of the Service Delivery Platform promptly. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to mitigate this vulnerability. No alternative mitigations or temporary fixes are indicated in the advisory.