Service Delivery Platform CVE-2026-60375

Oracle Communications Service Delivery Platform (Messaging Enabler) versions 12.2.1.4.0 and 14.1.2.0.0 are vulnerable to complete remote system compromise via unauthenticated network access, affecting any organization deploying this critical messaging infrastructure component. With a CVSS score of 9.8 and network-reachable attack surface on T3/IIOP protocols, this vulnerability poses an immediate risk of service disruption, data breach, and loss of control over messaging operations affecting downstream customers. The absence of available patches compounds the urgency of implementing interim containment measures.

Within 24 hours, inventory all systems running Oracle Communications Service Delivery Platform Messaging Enabler versions 12.2.1.4.0 or 14.1.2.0.0, document network locations, and immediately implement firewall rules to restrict T3 and IIOP protocol access to trusted administrative networks only; block all external access to these protocols. Within 7 days, deploy network-based IDS/IPS signatures to detect T3/IIOP exploitation attempts, establish continuous monitoring with alerts for protocol anomalies, contact Oracle Support daily to confirm patch availability timeline, and assess whether T3/IIOP protocols can be disabled without impacting business operations. Within 30 days, execute an upgrade plan to a patched version of Oracle Communications Service Delivery Platform once fixes are released; coordinate with business stakeholders on testing and deployment windows given the criticality of messaging infrastructure, and evaluate alternative solutions or architectural changes if patches are not forthcoming within 60 days.

Network segmentation restricting T3/IIOP protocol access to trusted administrative hosts only; firewall rules blocking all external access to affected systems; disabling T3/IIOP protocols entirely if not required for business operations; enhanced monitoring and IDS/IPS signatures to detect exploitation attempts against these protocols; asset inventory and isolation of affected systems to prevent lateral movement; preparation of upgrade procedures and non-production testing environments for immediate patch deployment upon vendor release.