What is the CVSS score of CVE-2026-60380?

CVE-2026-60380 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Service Delivery Platform are affected by CVE-2026-60380?

Oracle Service Delivery Platform versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical vulnerability (CVE-2026-60380, CVSS 9.8) enabling complete unauthenticated remote compromise over HTTP.

How to fix or mitigate CVE-2026-60380?

Within 24 hours: identify all systems running Oracle Service Delivery Platform versions 12.2.1.4.0 and 14.1.2.0.0 in your environment; assess network exposure and enable detailed logging on HTTP traffic to the Messaging Enabler component; contact Oracle to request emergency patch availability and timeline. Within 7 days: implement network segmentation or firewall rules restricting access to the Messaging Enabler component from authorized sources only; deploy Web Application Firewall rules to detect exploitation attempts; evaluate operational feasibility of temporarily disabling the component. Within 30 days: monitor Oracle security advisories for patch release; establish emergency change procedures to deploy updates within 48 hours of availability; validate systems post-patch; assess architectural alternatives to reduce reliance on affected versions.

Service Delivery Platform CVE-2026-60380

EUVD-2026-46786 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-hfm3-r589-65jj

Authentication Bypass Oracle Service Delivery Platform

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Description states easily exploitable, unauthenticated, network HTTP access yielding full platform takeover, so AV:N/AC:L/PR:N/UI:N with high C/I/A.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:19 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Service Delivery Platform. Successful attacks of this vulnerability can result in takeover of Service Delivery Platform. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) is possible in versions 12.2.1.4.0 and 14.1.2.0.0, where an unauthenticated remote attacker can compromise the platform over HTTP. Oracle rates this a CVSS 9.8 with high confidentiality, integrity, and availability impact, and it was disclosed in the July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Oracle Service Delivery Platform (SDP) is a telecom-oriented Fusion Middleware layer that exposes messaging and communication services to network operators and enterprises; the affected component is the Messaging Enabler, which brokers messaging traffic over HTTP. Because the flaw is remotely reachable and requires no authentication, the root cause is almost certainly an exposed HTTP-facing service endpoint that mishandles untrusted input. Oracle assigned no CWE (CWE: N/A) and its Critical Patch Update advisories are deliberately sparse, so the exact weakness class (e.g., injection, deserialization, or authentication bypass) cannot be confirmed from the available data.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); this is the primary and only vendor-sanctioned remediation, and Oracle does not publish standalone patches outside the CPU cycle, so the specific patched build must be obtained from that advisory and the linked patch set for your SDP release. No exact fixed version string is enumerated in the provided data - consult the CPU patch matrix for the correct download for 12.2.1.4.0 and 14.1.2.0.0. Until patching, restrict network access to the SDP Messaging Enabler HTTP endpoints to trusted management networks only (via firewall/ACL or reverse-proxy allowlisting), which reduces exposure of an unauthenticated network attack surface but may break legitimate messaging integrations that rely on that interface; place the service behind a WAF and monitor HTTP logs for anomalous requests as a detective compensating control.