CVE-2026-60389 in Service Delivery Platform
Summary
by MITRE • 07/22/2026
Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Service Delivery Platform. While the vulnerability is in Service Delivery Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Service Delivery Platform. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within Oracle Fusion Middleware's Service Delivery Platform, specifically within the Messaging Enabler component of the software stack. The affected versions include 12.2.1.4.0 and 14.1.2.0.0, representing critical security flaws that pose significant risks to enterprise infrastructure. The vulnerability demonstrates a high severity profile with a CVSS base score of 10.0, indicating complete compromise potential across confidentiality, integrity, and availability domains.
The technical flaw manifests as an easily exploitable condition that permits unauthenticated attackers to gain network-level access through HTTP protocols. This vulnerability's accessibility means that malicious actors require minimal privileges or specialized tools to initiate exploitation attempts. The attack vector operates over the network (AV:N) with low complexity requirements (AC:L), eliminating the need for authentication (PR:N) and user interaction (UI:N). The scope change aspect of this vulnerability indicates that successful exploitation can extend beyond the primary target system, potentially affecting additional products within the Oracle Fusion Middleware ecosystem. This characteristic aligns with CWE-284 access control weaknesses and represents a significant elevation in attack surface.
The operational impact of this vulnerability is catastrophic for organizations relying on Oracle Fusion Middleware platforms. Successful exploitation results in complete takeover of the Service Delivery Platform, enabling attackers to execute arbitrary code, modify system configurations, access sensitive data, and potentially establish persistent backdoors. The high confidentiality, integrity, and availability impacts (C:H/I:H/A:H) demonstrate that this vulnerability could lead to complete system compromise and data breaches. Organizations may experience service disruption, regulatory compliance violations, and significant financial losses due to unauthorized access to critical business systems.
Security professionals should implement immediate mitigations including network segmentation, firewall rule restrictions, and disabling unnecessary HTTP services to reduce attack surface exposure. The ATT&CK framework identifies this vulnerability as potentially enabling initial access techniques through network service exploitation followed by privilege escalation and lateral movement within the enterprise environment. Organizations must also consider implementing intrusion detection systems, monitoring for anomalous HTTP traffic patterns, and establishing robust patch management processes to address this critical vulnerability in affected versions. Regular security assessments and vulnerability scanning should be conducted to identify similar weaknesses across the entire Oracle Fusion Middleware deployment landscape, ensuring comprehensive protection against similar threats.