CVE-2026-60385

CriticalCVSS 9.8

Published: 21/07/2026(UTC)Updated: 28/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.45%

37th percentile - higher than 37% of all known CVEs

Summary

Vulnerability in Service Delivery Platform (Messaging Enabler component) allows an unauthenticated attacker to remotely take over the system via T3 or IIOP protocols. It requires only network access and no privileges or user interaction.

Risk Assessment

An attacker can gain full control of Service Delivery Platform, leading to loss of confidentiality, integrity, and availability of data.

Recommendation

Immediately apply the security patch provided by Oracle for versions 12.2.1.4.0 and 14.1.2.0.0.

Original NVD description (English source)

Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Service Delivery Platform. Successful attacks of this vulnerability can result in takeover of Service Delivery Platform. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).