External risk intelligence

Oracle Fusion Middleware Service Delivery Platform Takeover Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-82999

The vulnerability affects the Service Delivery Platform component of Oracle Fusion Middleware. Such middleware platforms are commonly deployed as internet-facing service enablers, APIs, or gateways to facilitate communication between services, making them frequently exposed to network access in modern infrastructure environments.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Oracle Fusion Middleware's Service Delivery Platform, which could allow unauthorized individuals to gain complete control of the platform through network access. While the vulnerability is within this specific component, successful attacks may impact other connected products, potentially leading to significant disruptions.

Enables unauthorized system control.
Critical for service delivery infrastructure.
Confirm relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending specially crafted requests over HTTP to the Service Delivery Platform. This platform, a component within Oracle Fusion Middleware, is easily exploitable by a low-privileged attacker with network access. Successful exploitation could lead to a complete takeover of the Service Delivery Platform, with potential impacts extending to other connected Oracle products.

Requires network access with low privileges.
Triggered via HTTP requests to the platform.
Risk of full platform takeover.

Live Threat

Current exploitation, exposure, and threat context

A low-privileged attacker with network access could compromise Oracle Fusion Middleware's Service Delivery Platform, potentially leading to a full takeover of the platform and impacting other connected products. This vulnerability carries a critical CVSS score of 9.9, indicating severe impacts to confidentiality, integrity, and availability.

Service Delivery Platform and connected products.
Network access via HTTP.
Complete takeover of the platform.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Service Delivery Platform in Oracle Fusion Middleware, specifically its Messaging Enabler component, is affected. This platform's role in enabling services suggests that application owners, platform teams, and potentially network/security teams are responsible for its upkeep and security. The first practical step is to identify all instances of this platform, assess their exposure and business criticality, locate the accountable owners, and then prioritize remediation efforts based on the identified risks.

Service Delivery Platform owners should address.
Verify network exposure and criticality.
Plan coordinated remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Oracle Fusion Middleware Service Delivery Platform?

It is a middleware component, specifically the Messaging Enabler, used to facilitate communication between services. Organizations use this platform as an infrastructure layer to manage, route, and deliver messages across connected software systems, acting as a gateway that supports critical service interactions.

What does CWE-284 mean for CVE-2026-82999?

This CVE falls under CWE-284, which is the class of Improper Access Control vulnerabilities. In this case, it means the platform fails to properly restrict or verify who can perform certain actions. Because of this weakness, the system incorrectly allows a low-privileged user to perform operations that should be restricted, ultimately enabling a full takeover.

How is this vulnerability triggered?

An attacker triggers this issue by sending specially crafted HTTP requests to the Messaging Enabler component of the Service Delivery Platform. It does not require complex conditions; simply having low-level network access and the ability to send HTTP traffic is sufficient to initiate the attack. Interactions that do not involve these specific HTTP request patterns do not trigger the flaw.

Is my environment at risk from this vulnerability?

According to Halo Surface Signal, this software is often deployed as an internet-facing gateway, which increases the likelihood of external accessibility. If your instance is reachable via the network, the risk is higher. You should determine if your specific deployment is exposed to the broader network or restricted to internal traffic only.

When should I start responding to CVE-2026-82999?

You should begin immediately by creating an inventory of all instances of the Service Delivery Platform running in your environment. Once identified, locate the specific teams responsible for these assets, evaluate their connectivity to the network, and determine their business criticality to prioritize your next steps for securing the platform.

References

www.oracle.com/security-alerts/cspusep2026.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.