Oracle Service Delivery Platform CVE-2026-60374

Exploitation requires network reachability to the Service Delivery Platform's T3 or IIOP protocol listeners (the WebLogic RMI ports) - these must be routable from the attacker to the target. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication and no user interaction are needed against affected versions 12.2.1.4.0 and 14.1.2.0.0. The primary limiting factor is exposure of the T3/IIOP ports: in deployments where these protocols are firewalled to a trusted admin network or disabled, remote exploitation is not possible. Only the two named versions with the Messaging Enabler component are in scope.

All available severity signals align toward high priority: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describes remote, low-complexity, unauthenticated exploitation with no user interaction and full CIA impact, yielding a 9.8 base score. Countervailing signals temper urgency for immediate mass-exploitation fear: there is no EPSS score in the provided data, the CVE is not listed in CISA KEV (no confirmed active exploitation), and no public exploit code was identified. SSVC-style reasoning: technical impact is total (takeover) and the flaw is likely automatable given the unauthenticated network vector, but exploitation status is 'none observed' per available sources. The practical risk is heavily gated by network exposure - T3/IIOP should never be Internet-facing, so environments that restrict these ports to trusted management networks face substantially lower real-world risk than the raw 9.8 implies.

An attacker who can reach the WebLogic-based Service Delivery Platform's T3 or IIOP listen port - for example a misconfigured deployment with these ports exposed beyond the management network - sends a crafted protocol message to the Messaging Enabler component without any credentials. Given the low attack complexity and full-impact rating, a successful message leads to complete compromise (takeover) of the platform. No public proof-of-concept was identified at time of analysis, but the unauthenticated, no-interaction profile makes this the kind of flaw that is quickly weaponized once details circulate.