CVE-2026-60384 in Service Delivery Platform
Summary
by MITRE • 07/22/2026
Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Service Delivery Platform. Successful attacks of this vulnerability can result in takeover of Service Delivery Platform. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
The vulnerability under analysis represents a critical security flaw within Oracle Fusion Middleware's Service Delivery Platform, specifically affecting the Messaging Enabler component. This weakness manifests in versions 12.2.1.4.0 and 14.1.2.0.0, creating a significant attack surface that adversaries can exploit without requiring authentication credentials. The vulnerability's classification as easily exploitable indicates that attackers need only basic network connectivity to initiate successful compromises, making it particularly dangerous in enterprise environments where such systems often reside within or accessible from untrusted networks.
The technical exploitation occurs through well-known Oracle communication protocols including T3 and IIOP which are part of the Oracle WebLogic Server's legacy messaging infrastructure. These protocols were designed for internal enterprise communication but have become common attack vectors due to their widespread deployment and inherent security limitations. The vulnerability allows unauthenticated remote code execution, enabling attackers to gain complete control over the affected Service Delivery Platform instances. This represents a severe compromise of system integrity as attackers can execute arbitrary commands with full privileges on the target systems.
The operational impact of this vulnerability extends beyond simple system compromise, as it affects all three core security principles defined in the CVSS scoring model. The high confidentiality impact means that attackers can access sensitive data and information processed by the Service Delivery Platform, potentially exposing proprietary business information, customer data, or internal communications. The integrity impact is equally concerning as attackers can modify system configurations, data, or application code to create backdoors or alter business processes. The availability impact threatens system stability and business continuity through potential denial-of-service conditions or complete system shutdowns that could disrupt critical enterprise operations.
From a threat modeling perspective, this vulnerability aligns with several ATT&CK techniques including T1046 for network service scanning and T1566 for malicious code injection through remote services. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) clearly demonstrates the severity with network accessibility, low attack complexity, no privilege requirements, and universal impact across all system components. Organizations implementing Oracle Fusion Middleware should immediately prioritize patching efforts as recommended by Oracle's security advisories, while also considering network segmentation strategies to limit exposure of vulnerable systems to untrusted networks. The vulnerability's characteristics suggest that organizations should implement monitoring for unusual T3 and IIOP traffic patterns and consider disabling these protocols entirely if they are not required for business operations, aligning with the principle of least privilege as defined in cybersecurity frameworks such as NIST SP 800-53.
The widespread deployment of Oracle Fusion Middleware components across enterprise environments makes this vulnerability particularly concerning for organizations that have not yet applied security patches. The combination of high attack surface, low exploitation complexity, and complete system compromise potential creates an environment where organizations face significant risk exposure without immediate remediation actions. Security teams should conduct comprehensive assessments of their Oracle infrastructure deployments to identify all affected systems and implement appropriate firewall rules to block T3 and IIOP traffic from unauthorized sources while ensuring that legitimate business requirements for these protocols are properly documented and justified.