CVE-2026-60375 in Service Delivery Platform
Summary
by MITRE • 07/22/2026
Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Service Delivery Platform. Successful attacks of this vulnerability can result in takeover of Service Delivery Platform. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within Oracle Fusion Middleware's Service Delivery Platform, specifically in the Messaging Enabler component that operates within version 12.2.1.4.0 and 14.1.2.0.0. The flaw represents a critical security weakness that enables unauthenticated attackers to gain complete control over the affected platform through network-based exploitation using established protocols such as T3 and IIOP. The CVSS score of 9.8 reflects the severe impact across confidentiality, integrity, and availability domains, indicating a high-risk exposure that could lead to full system compromise.
The technical nature of this vulnerability stems from insufficient authentication mechanisms within the Messaging Enabler component, allowing attackers to establish connections without proper credential verification. Attackers can leverage T3 protocol, which is used for remote method invocation in Oracle WebLogic Server, or IIOP (Internet Inter-ORB Protocol) to access underlying services and execute malicious operations. These protocols typically require authentication but in this case, the vulnerability permits unauthorized access that bypasses normal security controls.
The operational impact of successful exploitation includes complete takeover of the Service Delivery Platform, enabling attackers to execute arbitrary code, access sensitive data, modify system configurations, and potentially escalate privileges within the enterprise network. This vulnerability particularly affects organizations using Oracle Fusion Middleware environments where these specific versions remain active, creating a significant risk for businesses that have not yet patched or upgraded their systems. The ease of exploitation means that skilled attackers can quickly compromise affected systems without requiring specialized tools or extensive reconnaissance.
Organizations should immediately implement mitigations including applying the latest security patches from Oracle, disabling unnecessary protocols such as T3 and IIOP where possible, implementing network segmentation to limit access to affected systems, and monitoring for suspicious network activity. The vulnerability aligns with CWE-287 which addresses improper authentication issues, and represents a significant concern under ATT&CK framework category T1190 for exploits of remote services and T1071 for application layer protocols. Additional protective measures should include regular security assessments, network access controls, and maintaining updated threat intelligence to detect potential exploitation attempts against these specific Oracle Fusion Middleware versions.