CVE-2026-83020: Unauthenticated Remote Code Execution in Oracle Platform Security for Java (OPSS)

HERMES

HERMES THREAT SCORE & SECURITY PLATFORM SYSTEMIC RISK

Target: Oracle Platform Security for Java (OPSS) — Centralized Thirdparty Jars & Credential Store Framework (CSF)

Confidence: 99%

99 / 100

EXTREME

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 20 / 20

Threat Activity 19 / 20

Weaponization 20 / 20

Exposure 20 / 20

Prevalence 19 / 20

Impact 20 / 20

Exploit Maturity 20 / 20

Attack Chain Potential 20 / 20

⚖️ Divergence & Operational Rationale

Rated at CVSS 10.0 (Critical) with Scope Changed (S:C), Hermes scores CVE-2026-83020 at 99 (EXTREME). OPSS provides the universal security substrate for Oracle Fusion Middleware, managing JAAS authentication, policy stores, and the Credential Store Framework (CSF) where database passwords, encryption keys, and administrative secrets are persisted. Exploiting a bundled third-party library dependency allows an unauthenticated remote attacker to compromise the entire WebLogic security realm.

HASS

HASS AGENTIC SEVERITY & ENTERPRISE KEYSTORE SUBVERSION

Target: Java Authentication and Authorization Service (JAAS), OPSS Policy Store & CSF Keystore

Confidence: 96%

93 / 100

CRITICAL

Measures specific systemic risk arising from autonomy, tool authority, and cascading execution.

Dimension Breakdown

Autonomy 17 / 20

Tool Access 19 / 20

Privilege 20 / 15

Persistence 19 / 15

External Impact 18 / 15

Propagation 19 / 15

⚖️ Divergence & Operational Rationale

Breaching OPSS shatters all cryptographic boundaries across the Fusion Middleware topology. The attacker can extract all encrypted credentials stored in the Credential Store Framework (cPS/CSF), alter fine-grained entitlement policies, and achieve persistent root/administrator code execution across all domain managed servers.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-83020: Unauthenticated Remote Code Execution in Oracle Platform Security for Java (OPSS)VULNERABILITY

Connected Nodes: 1

Active Relationships (Outgoing)

→ affectsPRODUCTMicrosoft Office & 365 Apps

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Microsoft Office & 365 Apps documented in Hermes dossier.”

Supporting Verified Evidence:

• [vulnerability_report]
• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

Critical Advisory: Oracle September 2026 Critical Security Patch Update

CVSS v3.1: 10.0 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) / CWE-502: Deserialization of Untrusted Data. Disclosed in the Oracle Critical Security Patch Update (CSPU) on September 15, 2026. Maximum CVSS base score of 10.0 with Scope Changed (S:C). Unauthenticated remote attackers can execute arbitrary code over HTTP/HTTPS across all Oracle Fusion Middleware products relying on OPSS. Immediate patching mandatory.

Executive Summary

On September 15, 2026, Oracle published its September 2026 Critical Security Patch Update, disclosing CVE-2026-83020, a maximum-severity vulnerability in Oracle Platform Security for Java (OPSS), specifically within the Centralized Thirdparty Jars component. The vulnerability allows an unauthenticated remote attacker with network access via HTTP/HTTPS to completely compromise OPSS, causing a critical scope change that impacts all integrated Fusion Middleware products.

OPSS is the enterprise security framework embedded within Oracle WebLogic Server, Oracle SOA Suite, Oracle WebCenter, and Oracle Business Intelligence (OBIEE). It provides centralized cryptographic services, policy repositories, and the Credential Store Framework (CSF). The flaw stems from a critical unsafe deserialization vulnerability in a bundled third-party Java library packaged within the centralized OPSS classpath. Exploitation enables remote code execution without credentials, granting attackers direct access to the cwallet.sso keystore and database master keys.

---

1. Technical Context & Affected Software Matrix

OPSS acts as the foundational security layer for all Java EE applications running on Oracle Fusion Middleware, integrating with LDAP identity stores and database policy tables.

Parameter	Technical Specification	Operational Impact
CVE Identifier	CVE-2026-83020	Oracle CSPU September 2026 / Advisory
Vulnerability Class	Insecure Deserialization (CWE-502)	Remote code execution via third-party dependency in OPSS classpath
Affected Component	OPSS Centralized Thirdparty Jars (oracle.security.jps)	Shared Java libraries providing XML/JSON/object parsing
Protocol / Port	HTTP / HTTPS (Default ports 7001, 7002, 8001)	Exposed across all WebLogic managed servers
Authentication Required	None (PR:N)	Raw HTTP request without session or token
User Interaction	None (UI:N)	Autonomous machine-level exploitation
Scope Impact	Changed (S:C)	Affects all WebLogic domains, SOA suites, and connected databases
Privileges Obtained	Complete Server & Keystore Takeover	Host OS shell and extraction of CSF database passwords
Affected Versions	12.2.1.4.0 and 14.1.2.0.0	Supported Oracle Fusion Middleware platforms
Remediation Target	September 2026 PSU for OPSS / Fusion Middleware	Apply OPatch update and restart all domain servers

---

2. Vulnerability Anatomy & Root Cause Analysis

Third-Party Library Deserialization in OPSS Classpath

The Oracle Platform Security for Java framework incorporates centralized third-party libraries under:

$ORACLE_HOME/oracle_common/modules/oracle.jps/
$ORACLE_HOME/oracle_common/modules/thirdparty/

These libraries handle XML signature verification, SAML token processing, and inter-service object serialization for WebLogic security providers.

Prior to the September 2026 patch:

1. An outdated third-party library packaged inside the centralized JAR distribution contained a well-known gadget chain vulnerable to unsafe object deserialization.
2. When external HTTP requests targeted endpoints utilizing OPSS security tokens (such as WS-Security endpoints, SAML assertion consumer endpoints, or OPSS REST services), the application passed untrusted byte streams directly to an unvalidated ObjectInputStream.readObject() invocation.
3. Attackers can forge a serialized Java gadget payload using standard gadget chains (such as CommonsBeanutils, Spring, or Jackson variants present in the centralized classpath).
4. Upon deserialization, the payload executes arbitrary operating system commands under the context of the running WebLogic Java Virtual Machine (JVM).

POST /saml2/sp/acs/post HTTP/1.1
Host: wls.corp.internal:7001
Content-Type: application/x-www-form-urlencoded

SAMLResponse=rO0ABXNyACpvcmFjaGUuc2VjdXJpdHkuanBz...[SERIALIZED_GADGET_PAYLOAD]

Once execution is achieved inside the WebLogic JVM:

• The attacker invokes internal OPSS APIs to access the Credential Store Framework:

  CredentialStore cs = JpsContextFactory.getContextFactory().getContext().getServiceInstance(CredentialStore.class);

• The attacker dumps all database passwords, keystore passphrases, and symmetric keys stored in $DOMAIN_HOME/config/fmwconfig/bootstrap/cwallet.sso.

---

3. Attack Flow & Weaponization Mechanics

sequenceDiagram
    autonumber
    actor Attacker as Remote Attacker (Unauthenticated)
    participant WLS as WebLogic Server (Port 7001)
    participant OPSS as OPSS Security Subsystem (Centralized Jars)
    participant Keystore as CSF Keystore (cwallet.sso)
    participant DB as Corporate Database Clusters

    Attacker->>WLS: Send HTTP request with serialized Java gadget (CVE-2026-83020)
    WLS->>OPSS: Dispatch request to security provider for token parsing
    OPSS->>OPSS: Insecure readObject() invocation on vulnerable thirdparty jar
    Note over OPSS: Gadget chain triggers unauthenticated code execution in JVM
    OPSS-->>Attacker: Spawn reverse shell on host operating system
    Attacker->>Keystore: Read and decrypt cwallet.sso credential store
    Keystore-->>Attacker: Dump database sys/system passwords and TLS private keys
    Attacker->>DB: Connect directly to databases with stolen administrative credentials

---

4. Detection Engineering & Threat Hunting

Suricata Signature (Java Deserialization)

alert http any any -> any [7001,7002,8001] (
  msg:"HERMES THREAT - Oracle OPSS Insecure Deserialization Attempt (CVE-2026-83020)";
  flow:to_server,established;
  content:"rO0AB"; http_client_body;
  pcre:"/(SAMLResponse|token|wls-auth)=.*rO0AB[A-Za-z0-9+/=]{50,}/i";
  threshold:type limit, track by_src, count 1, seconds 60;
  reference:cve,2026-83020;
  reference:url,www.oracle.com/security-alerts/cspusep2026.html;
  classtype:attempted-admin;
  sid:202683020; rev:1;
)

WebLogic Log Inspection (KQL)

// Hunting query for Java deserialization errors and OPSS gadget execution
WebLogic_Diagnostic_CL
| where TimeGenerated >= ago(7d)
| where Message has_any ("ClassNotFoundException", "InvalidClassException", "oracle.security.jps", "readObject")
| extend ExceptionDetail = extract(@"Exception:\s+([^
]+)", 1, Message)
| project TimeGenerated, ServerName_s, ExceptionDetail, Message

Linux Host Shell Audit

## Check for suspicious child processes of the WebLogic Java process
pgrep -f "weblogic.Server" | while read pid; do
    echo "[+] Inspecting child processes of WebLogic PID $pid:"
    pstree -p $pid
done

## Audit access and modification times of the OPSS credential store
ls -lcu $DOMAIN_HOME/config/fmwconfig/bootstrap/cwallet.sso

---

5. Forensic Investigation & Incident Response Playbook

When investigating suspected exploitation of CVE-2026-83020:

1. JVM Memory Dump & Thread Analysis: Take a live thread dump and heap dump of the WebLogic JVM before restarting:

   jcmd $(pgrep -f "weblogic.Server") Thread.print > /tmp/wls_threads.txt
   jcmd $(pgrep -f "weblogic.Server") GC.heap_dump /tmp/wls_heap.hprof

   Analyze the heap dump with Eclipse Memory Analyzer (MAT) for suspicious ObjectInputStream instances.
2. Keystore Integrity & Access Triage: Verify whether $DOMAIN_HOME/config/fmwconfig/bootstrap/cwallet.sso was accessed or exfiltrated:

   ausearch -f $DOMAIN_HOME/config/fmwconfig/bootstrap/cwallet.sso -i

3. Database Credential Emergency Rotation: Because OPSS stores all database connection pool credentials in plaintext/reversible encryption in cwallet.sso, assume all database passwords (SYS, SYSTEM, schema users) are compromised and initiate immediate rotation.

---

6. Remediation, Patching & Hardening

1. Apply Oracle September 2026 Critical Security Patch Update: Apply the OPSS / Fusion Middleware PSU across all WebLogic domains:

   cd $ORACLE_HOME/OPSS_PATCH_SEP2026
   opatch apply

   Restart all AdminServers and managed servers.

2. Configure WebLogic Java Serialization Filter: Enable Java serialization filtering by adding the following JVM argument to setDomainEnv.sh:

   JAVA_OPTIONS="${JAVA_OPTIONS} -Djdk.serialFilter=!*;   java.lang.*;java.util.*;oracle.security.jps.**"

3. Isolate WebLogic Administration and Managed Server Ports: Ensure ports 7001 and 7002 are never exposed to untrusted networks or the public Internet.

---

7. Related Intelligence & Attack Paths

Oracle WebLogic Server Intelligence Analyze WebLogic infrastructure running the core OPSS security providers.

Oracle WebLogic RCE (CVE-2026-83021) Examine the companion Web Container vulnerability in the same patch bundle.

Active Directory Credential Attacks Playbook Investigate post-compromise lateral movement following database credential exposure.