Service Delivery Platform CVE-2026-60377

Exploitation requires network reachability to the Oracle WebLogic T3 and/or IIOP protocol listeners serving the SDP Messaging Enabler component, plus a valid low-privileged account (CVSS PR:L, so authenticated per the vector). No user interaction is required (UI:N) and attack complexity is low (AC:L). The limiting factor is precisely this authentication requirement combined with exposure of the proprietary T3/IIOP ports: where those ports are restricted to an internal management network via firewalls or WebLogic connection filters, an external unauthenticated attacker cannot reach the vulnerable service. Applies specifically to SDP versions 12.2.1.4.0 and 14.1.2.0.0.

The signals mostly align toward high priority: CVSS 3.1 is 9.9 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L - network reachable, low complexity, only low privileges, no user interaction, and a scope change amplifying blast radius. However, the practical risk is bounded by two factors the raw 9.9 obscures: exploitation requires an authenticated account (PR:L), and it requires reachability to the T3/IIOP ports, which in well-managed environments are firewalled to internal management networks rather than internet-exposed. EPSS was not provided in the input, so exploitation probability cannot be quantified here; there is no KEV listing and no POC referenced, so this is not confirmed active exploitation. Net: treat as a real near-term priority for any exposed SDP deployment given the trivial complexity and scope change, but the authentication and segmentation requirements make mass exploitation less likely than an unauthenticated internet-facing flaw of the same score.

An attacker holding or phishing any low-privileged SDP account, or with a foothold in the network segment where WebLogic T3/IIOP is reachable, connects to the Messaging Enabler service and issues a crafted T3/IIOP request abusing the flaw to read and alter all SDP-accessible data and disrupt service. Because of the scope change, impact can extend to other products co-hosted in the WebLogic domain. No public proof-of-concept is currently referenced, so this reflects the CVSS-derived attack profile rather than an observed exploit.