What is the CVSS score of CVE-2026-60379?

CVE-2026-60379 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Service Delivery Platform are affected by CVE-2026-60379?

Oracle Service Delivery Platform (Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0) contains a critical flaw that grants unauthenticated attackers complete system takeover, with confirmed…

How to fix or mitigate CVE-2026-60379?

Within 24 hours, inventory all Oracle Fusion Middleware deployments to identify systems running versions 12.2.1.4.0 or 14.1.2.0.0, assess network exposure, and isolate affected systems from untrusted networks if operationally feasible. Within 7 days, implement immediate compensating controls: restrict network access to Messaging Enabler SOAP endpoints via firewall rules or WAF policy, disable SOAP messaging if not business-critical, and activate detailed logging and alerting on all SOAP requests to detect exploitation attempts. Within 30 days, monitor for Oracle's Critical Patch Update release, test the patch in non-production environments replicating production configurations, and execute phased deployment; concurrently evaluate long-term alternatives including platform migration if patching introduces unacceptable operational risk.

Oracle Service Delivery Platform CVE-2026-60379

EUVD-2026-46785 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-32hh-5h5c-mf3w

Authentication Bypass Oracle Service Delivery Platform

10.0

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

10.0 CRITICAL

Unauthenticated network SOAP access (AV:N/PR:N) with low complexity and full takeover crossing into other products justifies S:C and C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:18 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 10.0

DescriptionCVE.org

Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SOAP to compromise Service Delivery Platform. While the vulnerability is in Service Delivery Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Service Delivery Platform. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Complete takeover of Oracle Service Delivery Platform is achievable by an unauthenticated remote attacker via SOAP requests to the Messaging Enabler component, affecting Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0. Rated CVSS 10.0 with a scope change, successful exploitation can pivot to compromise additional connected products beyond SDP itself. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the maximum score and trivial exploitation warrant urgent patching via Oracle's July 2026 Critical Patch Update.

Technical ContextAI

Oracle Service Delivery Platform (SDP) is a Fusion Middleware telecom/enterprise messaging framework used to deliver and orchestrate messaging services; the vulnerable Messaging Enabler component exposes SOAP web-service endpoints over the network. Because the input arrives via SOAP and requires no authentication, the defect most likely lies in insufficient validation or authorization within the SOAP request-handling path. Oracle did not assign a CWE (listed as N/A), so the precise root-cause class is not confirmed from available data; the scope-change flag (S:C) indicates the vulnerable component can affect resources managed by a different security authority, typical of middleware that brokers messaging to downstream systems.

RemediationAI

Apply the Oracle July 2026 Critical Patch Update, which contains the fix for both affected releases (12.2.1.4.0 and 14.1.2.0.0); consult https://www.oracle.com/security-alerts/cpujul2026.html for the exact patch bundles and any prerequisite patch levels - an exact fixed build number is not stated in the available data, so treat the CPU as the patch source. Until the CPU can be applied, restrict network exposure of the Messaging Enabler SOAP endpoint: place SDP behind network segmentation or a firewall/reverse proxy that permits SOAP traffic only from trusted messaging clients, and block untrusted access to the SOAP listener port (trade-off: legitimate messaging integrations from outside the trusted zone will break). Because exploitation is unauthenticated, adding an authenticating gateway or WAF in front of the SOAP interface can reduce exposure, though it is a compensating control, not a substitute for the vendor patch. No independently confirmed workaround is published by Oracle beyond the CPU.