What is the CVSS score of CVE-2026-60375?

CVE-2026-60375 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Service Delivery Platform are affected by CVE-2026-60375?

Oracle Communications Service Delivery Platform (Messaging Enabler) versions 12.2.1.4.0 and 14.1.2.0.0 are vulnerable to complete remote system compromise via unauthenticated network access,…

How to fix or mitigate CVE-2026-60375?

Within 24 hours, inventory all systems running Oracle Communications Service Delivery Platform Messaging Enabler versions 12.2.1.4.0 or 14.1.2.0.0, document network locations, and immediately implement firewall rules to restrict T3 and IIOP protocol access to trusted administrative networks only; block all external access to these protocols. Within 7 days, deploy network-based IDS/IPS signatures to detect T3/IIOP exploitation attempts, establish continuous monitoring with alerts for protocol anomalies, contact Oracle Support daily to confirm patch availability timeline, and assess whether T3/IIOP protocols can be disabled without impacting business operations. Within 30 days, execute an upgrade plan to a patched version of Oracle Communications Service Delivery Platform once fixes are released; coordinate with business stakeholders on testing and deployment windows given the criticality of messaging infrastructure, and evaluate alternative solutions or architectural changes if patches are not forthcoming within 60 days.

Service Delivery Platform CVE-2026-60375

EUVD-2026-46781 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-g5xg-q9x4-wrhh

Authentication Bypass Oracle Service Delivery Platform

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:17 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Service Delivery Platform. Successful attacks of this vulnerability can result in takeover of Service Delivery Platform. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Complete takeover of Oracle Communications Service Delivery Platform (Messaging Enabler component) versions 12.2.1.4.0 and 14.1.2.0.0 is possible by an unauthenticated remote attacker reaching the server over the T3 or IIOP protocols. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N, full C/I/A impact), placing it among Oracle's most severe July 2026 Critical Patch Update fixes. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the T3/IIOP attack surface has a long history of trivially weaponized deserialization exploits.