CVE-2026-60387 in Service Delivery Platform
Summary
by MITRE • 07/22/2026
Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Service Delivery Platform. Successful attacks of this vulnerability can result in takeover of Service Delivery Platform. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Fusion Middleware's Service Delivery Platform, specifically within the Messaging Enabler component that operates at the service delivery layer of the middleware stack. The flaw affects two major version streams including 12.2.1.4.0 and 14.1.2.0.0, making it a widespread concern across Oracle's middleware ecosystem. The vulnerability stems from insufficient authentication controls within the T3 and IIOP protocol implementations that govern communication between middleware components. These protocols serve as foundational communication mechanisms for enterprise applications, with T3 being Oracle's proprietary protocol and IIOP representing the standard CORBA Inter-ORB Protocol used for distributed object communication.
The technical nature of this vulnerability allows for highly dangerous unauthenticated access through network-based attack vectors utilizing either T3 or IIOP protocols. Attackers can exploit this weakness without requiring any valid credentials or prior authentication, making it particularly severe from a security perspective. The CVSS 3.1 score of 9.8 indicates the highest severity classification with complete impacts across confidentiality, integrity, and availability domains. This means that successful exploitation could result in full system compromise where attackers gain complete control over the Service Delivery Platform, potentially enabling them to exfiltrate sensitive data, modify critical system configurations, or disrupt essential services. The attack vector requires only network access, eliminating the need for physical presence or insider knowledge, which significantly increases the attack surface and threat probability.
The operational impact of this vulnerability extends beyond simple service disruption to encompass complete system takeover scenarios that could affect enterprise business continuity. Organizations relying on Oracle Fusion Middleware for critical business operations face substantial risk exposure, as attackers could leverage this vulnerability to gain unauthorized access to enterprise data repositories, manipulate transactional processes, or establish persistent backdoor access points within the network infrastructure. The implications are particularly concerning given that Oracle Fusion Middleware typically serves as a core component in enterprise application architectures where service delivery platforms handle sensitive business-critical functions including customer management, financial transactions, and operational workflows.
Security mitigations for this vulnerability should include immediate implementation of network segmentation measures to restrict access to T3 and IIOP ports, deployment of firewall rules limiting these protocol communications to trusted network segments only, and application of Oracle's official security patches as soon as they become available. Organizations should also conduct comprehensive network scans to identify any unauthorized access points or exposed services that might enable exploitation. The vulnerability aligns with CWE-287 which addresses improper authentication issues, and maps to ATT&CK technique T1190 for exploiting vulnerabilities in remote services. Additional defensive measures include implementing network monitoring solutions to detect unusual T3 and IIOP traffic patterns, regular security assessments of middleware configurations, and establishing incident response procedures specifically tailored to address middleware-level compromises. Organizations should also consider disabling unused protocols entirely and implementing zero-trust network access models that verify all communications regardless of source location or previous authentication status.