Oracle Service Delivery Platform CVE-2026-60376

The exploitable prerequisite is network reachability of the Service Delivery Platform's WebLogic T3 or IIOP protocol listener; the CVSS metrics AV:N/AC:L/PR:N/UI:N confirm no authentication, no user interaction, and low complexity against affected versions 12.2.1.4.0 and 14.1.2.0.0 running the Messaging Enabler component. What limits exploitation is exposure of those RMI ports - in deployments where T3/IIOP is firewalled to internal management segments, an external attacker cannot reach the vulnerable listener. There is no configuration toggle stated as required in the description; the default reachability of the T3/IIOP endpoint is the enabling condition, and only the affected version/component combination is at risk.

Signals are broadly aligned toward high priority: the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes a network-reachable, low-complexity, unauthenticated attack yielding total compromise, matching the 9.8 base score. Counterbalancing this, there is no EPSS score in the provided data, no POC or exploit code identified, and no CISA KEV listing, so exploitation is currently theoretical rather than observed. The primary limiting factor is exposure: T3/IIOP listeners should not be internet-facing in a well-segmented deployment, so real-world risk hinges on whether the WebLogic RMI ports are reachable by the attacker. No SSVC decision fields or automatable/technical-impact metadata were supplied. Net assessment: treat as a genuine critical-priority patch for any environment where the SDP T3/IIOP ports are reachable, but note that absence of EPSS/KEV means widespread active exploitation is not confirmed.

An attacker who can reach the SDP server's WebLogic T3 or IIOP listener port sends a crafted RMI request to the Messaging Enabler component without any credentials. Because the vector is network, low-complexity, and unauthenticated, a single malicious serialized payload can yield full server takeover with confidentiality, integrity, and availability impact. No public POC is currently identified, but the T3/IIOP vector is well-trodden in existing WebLogic exploitation tooling.