Service Delivery Platform CVE-2026-60381

Exploitation requires network reachability to the WebLogic T3 and/or IIOP listener of the Service Delivery Platform (Messaging Enabler component) and low-privilege authenticated access to the platform (CVSS PR:L) - it is not exploitable by a fully anonymous, unauthenticated attacker. No user interaction is required (UI:N) and attack complexity is low (AC:L). The practical limiting factors are: the attacker must already hold some valid low-privilege credential or foothold, and the T3/IIOP ports must be reachable from the attacker's position - deployments that firewall or connection-filter T3/IIOP to trusted management hosts substantially reduce exposure. Only Service Delivery Platform 12.2.1.4.0 and 14.1.2.0.0 are affected.

The signals point to a genuine high priority, though real-world reach is bounded by product prevalence. CVSS 3.1 is 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H): network reachable, low attack complexity, only low privileges required, no user interaction, full C/I/A impact, and a scope change that Oracle explicitly says 'may significantly impact additional products.' That scope change is what pushes it to near-maximum severity. However, exploitation is NOT fully unauthenticated - PR:L means the attacker must already hold some low-privilege access or a foothold, which is a meaningful limiting factor. EPSS is not provided in the input, so exploitation probability cannot be quantified. It is not in CISA KEV and no POC is referenced, so there is no evidence of active exploitation - this is a patch-now-on-severity case, not a fire-drill-on-active-exploitation case. Note a minor tension in the source data: the tag says 'Information Disclosure,' but the CVSS vector and description indicate full takeover (C:H/I:H/A:H), so the tag understates the actual impact - trust the vector over the tag.

An attacker who has obtained low-privilege access to the environment (e.g., a limited application account or an internal foothold) sends crafted T3 or IIOP requests to the WebLogic-hosted Service Delivery Platform Messaging Enabler over the network. Because attack complexity is low and no user interaction is needed, they trigger the flaw to take over the SDP instance and, thanks to the scope change, pivot to impact additional integrated products. No public POC or exploit code is referenced in the source data at time of analysis.