What is the CVSS score of CVE-2026-60374?

CVE-2026-60374 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Service Delivery Platform are affected by CVE-2026-60374?

Oracle Service Delivery Platform (Messaging Enabler component) in versions 12.2.1.4.0 and 14.1.2.0.0 is vulnerable to complete remote system takeover by unauthenticated attackers, exposing…

How to fix or mitigate CVE-2026-60374?

Within 24 hours: Conduct inventory of Oracle Service Delivery Platform instances running versions 12.2.1.4.0 or 14.1.2.0.0, identify network-exposed systems, and immediately restrict access to T3 protocol endpoints (ports 7001/7002) and IIOP endpoints (ports 9001/9002) via firewall rules or network segmentation. Within 7 days: Disable Messaging Enabler component if operationally feasible, review Oracle Security Advisories for interim workarounds, and deploy enhanced monitoring on all affected endpoints for suspicious connection activity. Within 30 days: Engage Oracle Support for patch availability timeline and deployment strategy, conduct business impact analysis on alternative Fusion Middleware versions or replacement platforms, and establish authentication enforcement via reverse proxy or application-layer controls pending permanent patching.

Oracle Service Delivery Platform CVE-2026-60374

EUVD-2026-46780 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-8r4h-j5r3-h9m7

Authentication Bypass Oracle Service Delivery Platform

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated remote takeover over T3/IIOP with no user interaction gives AV:N/AC:L/PR:N/UI:N, and full platform compromise yields C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:16 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Service Delivery Platform. Successful attacks of this vulnerability can result in takeover of Service Delivery Platform. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Complete takeover of Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) is achievable by an unauthenticated remote attacker who reaches the T3 or IIOP protocol endpoints. Versions 12.2.1.4.0 and 14.1.2.0.0 are affected, carrying a maximum-severity CVSS 9.8 with full confidentiality, integrity, and availability loss. No public exploit is identified at time of analysis and the CVE is not in CISA KEV, but the T3/IIOP attack surface is historically a high-value target in the Oracle WebLogic/Fusion stack.

Technical ContextAI

The Service Delivery Platform is an Oracle Fusion Middleware product built on the Oracle WebLogic Server (Java EE) technology stack; the affected 'Messaging Enabler' component handles messaging services within that platform. Exploitation occurs over T3 and IIOP - the proprietary RMI transport protocols WebLogic exposes for remote EJB/JNDI and administrative operations. Historically, unauthenticated 'takeover' bugs reachable via T3/IIOP in this stack stem from insecure Java deserialization of untrusted objects (CWE-502) delivered through these protocols, allowing gadget-chain-driven remote code execution. The official CWE is listed as N/A in the source data, so the root-cause class here is inferred from the protocol/impact pattern rather than confirmed by NVD.

RemediationAI

Apply the fixes from Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the primary and only vendor-sanctioned remediation for the affected 12.2.1.4.0 and 14.1.2.0.0 versions - Oracle does not publish standalone fix version strings in the CPU, so track the specific patch bundle referenced in that advisory for your deployment. Because the attack vector is T3/IIOP, the strongest compensating control until patching is to restrict or disable these protocols: use WebLogic connection filters (e.g. weblogic.security.net.ConnectionFilterImpl) to allow T3/IIOP only from trusted management hosts, and ensure the T3/IIOP listen ports are never exposed to the Internet or untrusted segments via perimeter and host firewalls. Trade-offs: connection filters and port blocking can break legitimate remote EJB clients, WLST administration, and inter-node cluster communication, so validate that management tooling and application clients still function after tightening. Disabling IIOP is safe only if no CORBA/RMI-IIOP clients depend on it.