CVE-2026-60381
CriticalCVSS 9.9Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Vulnerability in Oracle Service Delivery Platform (Messaging Enabler component) allows a low-privileged attacker with network access via T3/IIOP to take over the platform. Attacks may impact additional products (scope change).
Risk Assessment
Risk of full compromise of the Service Delivery Platform and potentially other systems, leading to loss of confidentiality, integrity, and availability.
Recommendation
Apply the Oracle patch for versions 12.2.1.4.0 and 14.1.2.0.0 immediately. Restrict network access to T3 and IIOP ports.
Original NVD description (English source)
Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Service Delivery Platform. While the vulnerability is in Service Delivery Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Service Delivery Platform. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).