What is the CVSS score of CVE-2026-60378?

CVE-2026-60378 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Service Delivery Platform are affected by CVE-2026-60378?

Oracle Communications Service Delivery Platform's Messaging Enabler (versions 12.2.1.4.0 and 14.1.2.0.0) contains a CRITICAL vulnerability enabling unauthenticated remote takeover of messaging…

How to fix or mitigate CVE-2026-60378?

Within 24 hours, inventory all systems running affected versions (12.2.1.4.0 or 14.1.2.0.0) and isolate them to protected network segments inaccessible from untrusted sources; preserve all logs of platform access attempts for forensic analysis. Within 7 days, deploy Web Application Firewall (WAF) rules and network access controls restricting HTTP/HTTPS traffic to known administrative sources only, and enable detailed audit logging on all API endpoints. Within 30 days, monitor Oracle's Critical Patch Updates for security fixes and establish an upgrade plan to unaffected versions; prioritize this migration as compensating controls provide limited long-term protection.

Service Delivery Platform CVE-2026-60378

EUVD-2026-46784 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-774w-564v-393v

Authentication Bypass Oracle Service Delivery Platform

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:18 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Service Delivery Platform. Successful attacks of this vulnerability can result in takeover of Service Delivery Platform. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle Communications Service Delivery Platform (Messaging Enabler component) versions 12.2.1.4.0 and 14.1.2.0.0 allows an unauthenticated remote attacker to take over the platform via crafted HTTP requests. Oracle rates this 9.8 (CVSS 3.1) with full confidentiality, integrity, and availability impact, disclosed in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.