What is the CVSS score of CVE-2026-60377?

CVE-2026-60377 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L. EPSS exploitation probability: 0.4%.

Which versions of Service Delivery Platform are affected by CVE-2026-60377?

Oracle Communications Service Delivery Platform (Messaging Enabler) versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical vulnerability (CVSS 9.9) enabling authenticated attackers to read and modify…

How to fix or mitigate CVE-2026-60377?

Within 24 hours: Identify all instances of SDP versions 12.2.1.4.0 and 14.1.2.0.0 in production and restrict network access to WebLogic T3/IIOP ports (7001-7002) to essential administrative systems only; disable these protocols if operationally feasible. Within 7 days: Upon vendor patch release, apply immediately to all affected instances; until then, enforce role-based access controls within the WebLogic domain to minimize low-privileged user access and enable comprehensive authentication logging and alerting. Within 30 days: Complete patching across all environments, perform forensic review of access logs for unauthorized activity, and establish baseline monitoring for anomalous protocol access and data modifications.

Service Delivery Platform CVE-2026-60377

EUVD-2026-46783 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-hv6c-fv6v-4mc9

Authentication Bypass Denial Of Service Oracle Service Delivery Platform

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

vuln.today AI

9.9 CRITICAL

Network-reachable via T3/IIOP with low complexity but requiring an authenticated low-privilege account (PR:L); scope change (S:C) from cross-product impact; full confidentiality/integrity and partial availability loss.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:17 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 9.9

DescriptionCVE.org

Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Service Delivery Platform. While the vulnerability is in Service Delivery Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Service Delivery Platform accessible data as well as unauthorized access to critical data or complete access to all Service Delivery Platform accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Service Delivery Platform. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L).

AnalysisAI

Privilege-abusing remote compromise in Oracle Communications Service Delivery Platform (Messaging Enabler component), versions 12.2.1.4.0 and 14.1.2.0.0, lets a low-privileged attacker reachable over the WebLogic T3/IIOP protocols read and modify all SDP-accessible data and cause partial denial of service. The CVSS 3.1 base score reaches 9.9 because of a scope change: the flaw sits in SDP but successful attacks significantly impact other products co-hosted in the WebLogic domain. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the low attack complexity over a network-facing T3/IIOP surface makes it a high-priority patch.

Technical ContextAI

Service Delivery Platform is an Oracle Communications product built on the Oracle Fusion Middleware / WebLogic Server stack; the affected Messaging Enabler component exposes remote services over WebLogic's proprietary T3 and CORBA IIOP RMI protocols. These protocols are historically dangerous attack surfaces in the Oracle/WebLogic ecosystem because they transport serialized Java objects and remote method invocations. Oracle did not assign a CWE (listed as N/A), but the pattern of a scope change plus full C/I impact over an authenticated RMI channel is consistent with an authorization-bypass or deserialization/injection weakness that lets an authenticated user act beyond its privilege boundary and reach adjacent WebLogic-hosted components.

RemediationAI

Apply the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html), the vendor-released patch covering the affected 12.2.1.4.0 and 14.1.2.0.0 branches; Oracle CPU fixes must be applied as the full quarterly bundle. Until patching is possible, reduce exposure of the T3/IIOP attack surface: restrict access using WebLogic connection filters (weblogic.security.net.ConnectionFilterImpl) to permit only trusted management hosts, and place the SDP/WebLogic admin and messaging ports behind firewall segmentation so they are unreachable from user or internet networks. Because exploitation needs only low privileges, also review SDP account provisioning and rotate credentials for low-privilege accounts. Trade-off: connection filters and port restrictions can break legitimate inter-node or client T3/IIOP traffic, so validate against your integration topology before enforcing. These are compensating controls only; the CPU patch is the durable fix.