CVE-2026-60389
CriticalCVSS 10.0Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
Vulnerability in Service Delivery Platform (Messaging Enabler component) allows an unauthenticated attacker to remotely take over the system via HTTP. The attack may also impact additional products (scope change). It requires only network access and no privileges or user interaction.
Risk Assessment
An attacker can gain full control of Service Delivery Platform and potentially other products, leading to loss of confidentiality, integrity, and availability of data across a broader scope.
Recommendation
Immediately apply the security patch provided by Oracle for versions 12.2.1.4.0 and 14.1.2.0.0.
Original NVD description (English source)
Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Service Delivery Platform. While the vulnerability is in Service Delivery Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Service Delivery Platform. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).