Oracle Service Delivery Platform CVE-2026-60379

Exploitation requires network access to the Oracle Service Delivery Platform Messaging Enabler SOAP interface - the specific prerequisite is that this SOAP endpoint is reachable by the attacker. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication, no user interaction, and low complexity, so against a default, network-exposed SDP deployment there are no further special conditions. The primary limiting factor is network reachability of the SOAP listener: deployments where the Messaging Enabler is confined to an internal or segmented network, or fronted by an authenticating gateway, materially raise the bar. Only the two supported versions 12.2.1.4.0 and 14.1.2.0.0 are stated as affected.

Every CVSS 3.1 signal points to maximum priority: AV:N (network), AC:L (low complexity), PR:N (unauthenticated), UI:N (no user interaction), S:C (scope change), and full C:H/I:H/A:H impact yield the ceiling score of 10.0. Oracle's own description labels it 'easily exploitable' with 'takeover' as the outcome, corroborating the vector. Counterbalancing signals are notably absent: no EPSS score was provided, the CVE is not in CISA KEV, no SSVC decision was supplied, and no POC is referenced - so real-world exploitation probability cannot be quantified from the input. The realistic read is that intrinsic severity is unambiguous and worst-case, while observed in-the-wild activity is currently unproven; prioritize on the strength of the vector and unauthenticated reachability rather than waiting for exploitation telemetry.

An attacker with network reachability to the SDP Messaging Enabler crafts a malicious SOAP request and sends it to the exposed web-service endpoint without any credentials, triggering the vulnerability and gaining control of the platform. Given AC:L and PR:N, the attack requires no special timing, no user interaction, and no prior access, and the scope change lets the attacker leverage the compromised SDP to reach connected downstream products. No public POC is referenced, so an exploit would need to be developed.