What is the CVSS score of CVE-2026-60376?

CVE-2026-60376 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Service Delivery Platform are affected by CVE-2026-60376?

Oracle Communications/Fusion Middleware Service Delivery Platform Messaging Enabler (versions 12.2.1.4.0 and 14.1.2.0.0) contains a critical remote code execution vulnerability enabling…

How to fix or mitigate CVE-2026-60376?

Within 24 hours: Inventory all Oracle Communications/Fusion instances, identify those running Messaging Enabler on versions 12.2.1.4.0 or 14.1.2.0.0, and document network exposure and data sensitivity. Within 7 days: Implement firewall rules to restrict T3 and IIOP protocol access from untrusted networks, deploy intrusion detection signatures targeting T3/IIOP deserialization attacks, and consider temporary service suspension if operationally feasible. Within 30 days: Monitor Oracle Critical Patch Update advisories for patch availability; develop and test upgrade path to patched version or alternative messaging platform if patch timeline is extended.

Oracle Service Delivery Platform CVE-2026-60376

EUVD-2026-46782 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-g8m3-53j5-qp3p

Authentication Bypass Oracle Service Delivery Platform

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable T3/IIOP RMI flaw with low complexity and no user interaction yielding full product takeover, so PR:N/UI:N and C/I/A all High.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:17 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Service Delivery Platform. Successful attacks of this vulnerability can result in takeover of Service Delivery Platform. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Complete takeover of Oracle Communications/Fusion Middleware Service Delivery Platform (versions 12.2.1.4.0 and 14.1.2.0.0, Messaging Enabler component) is possible by an unauthenticated remote attacker reaching the T3 or IIOP protocol. The flaw scores CVSS 3.1 9.8 with full confidentiality, integrity, and availability impact and requires no user interaction; no public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the T3/IIOP attack surface historically maps to WebLogic-style deserialization abuse. It was self-reported by Oracle and disclosed in the July 2026 Critical Patch Update.

Technical ContextAI

Service Delivery Platform is an Oracle Fusion Middleware / Oracle Communications component that brokers messaging and network-service enablement; like most Fusion Middleware products it is layered on Oracle WebLogic Server, which exposes the proprietary T3 and CORBA IIOP remote protocols for RMI. The affected 'Messaging Enabler' subcomponent is reachable over these RMI channels. Oracle did not assign a CWE (listed N/A), but the T3/IIOP-over-RMI vector with full system takeover is the classic signature of Java object deserialization weaknesses (CWE-502 class) that have repeatedly affected WebLogic-based stacks, where a crafted serialized object delivered through the RMI listener is deserialized into attacker-controlled code execution. The CPE-equivalent affected identifiers per Oracle and ENISA EUVD are Service Delivery Platform 12.2.1.4.0 and 14.1.2.0.0.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) - Patch available per vendor advisory; Oracle did not publish an isolated fixed build number in the provided data, so identify the exact patch for your 12.2.1.4.0 or 14.1.2.0.0 baseline directly from the CPU matrix. Until patching is complete, reduce exposure of the underlying WebLogic RMI surface: restrict or firewall the T3 and IIOP listener ports so they are reachable only from trusted management networks, and use WebLogic connection filters (weblogic.security.net.ConnectionFilterImpl) to allow-list source hosts for T3/T3S/IIOP - note this can break legitimate remote JMX/RMI clients and clustered node communication, so validate cluster and admin connectivity after applying. Where the Messaging Enabler's IIOP is not required, disable the IIOP protocol on the affected managed servers to shrink the attack surface, accepting loss of CORBA client interoperability.