← Back to the live CVE advisory feed

CVE-2026-83020: Oracle Platform Security for Java

Severity

10 (CRITICAL)

Vendor

ORACLE

Affected versions

12.2.1.4.0, 14.1.2.0.0

Fixed version

unknown

Patch status

Unknown

Published

2026-09-15T20:18:09.060

Modified

2026-09-16T19:42:12.090

Why it matters

Unauthenticated attackers can easily exploit this critical vulnerability via HTTP to gain full control (takeover) of Oracle Platform Security for Java. This could also significantly impact other connected products, posing a severe risk to confidentiality, integrity, and availability of affected syst

Recommended admin actions

• Prioritize immediate validation against Oracle Platform Security for Java deployments due to critical severity.
• Identify and review internet-facing instances of Oracle Platform Security for Java as they are easily exploitable via HTTP.
• Evaluate network access controls to restrict HTTP access to affected systems where possible.
• Monitor vendor advisories for patch availability and apply updates promptly once released.

Technical summary

Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Platform Security for Java. While the vulnerability is in Oracle Platform Security for Java, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

View the official NVD record for CVE-2026-83020

AI-enriched (MEDIUM confidence). Validate against the vendor advisory before taking production action.