Service Delivery Platform CVE-2026-60380

Exploitation requires network HTTP reachability to the Oracle Service Delivery Platform Messaging Enabler component on affected versions 12.2.1.4.0 or 14.1.2.0.0 - per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there is no authentication, no user interaction, and no special configuration barrier, so any attacker who can route HTTP to the service can attempt it. The primary limiting factor is exposure: SDP is a telecom/back-end platform typically deployed on internal or operator networks rather than the public internet, so realistic risk hinges on whether the Messaging Enabler HTTP interface is reachable from an attacker-controlled network segment. Only the two named versions are in scope.

All available signals point to high real-world risk severity but limited confirmation of active exploitation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes the most dangerous profile: network-reachable, low complexity, no privileges, no user interaction, with full CIA impact resulting in takeover - Oracle explicitly calls it 'easily exploitable.' However, there is no EPSS score provided, no POC, and no CISA KEV listing, so this is currently a high-severity-by-design rating rather than evidence of widespread exploitation. No SSVC decision data was provided. The tag 'Information Disclosure' is narrower than the description's 'takeover' claim and the full C/I/A impact - this conflict suggests the tag is incomplete metadata rather than a limit on impact; treat the CVSS/description as authoritative and verify scope with Oracle.

An attacker who can reach the SDP Messaging Enabler over HTTP sends a crafted unauthenticated request to the exposed endpoint and, because no privileges or user interaction are required, gains full control of the Service Delivery Platform. No public exploit code was identified at time of analysis, but the low attack complexity and lack of authentication make weaponization straightforward once details or a patch diff become available.