Service Delivery Platform CVE-2026-60382

Exploitation requires only network access to the Service Delivery Platform Messaging Enabler HTTP interface - per the CVSS vector AV:N/AC:L/PR:N/UI:N, no authentication, no privileges, and no user interaction are needed against affected versions 12.2.1.4.0 and 14.1.2.0.0. The concrete prerequisite is HTTP reachability of the messaging endpoint; the real-world limiting factor is deployment topology, since SDP Messaging Enablers are typically fielded inside carrier/operator networks rather than on the public Internet, so an attacker must first be able to route to that HTTP service. Impact is limited to availability (complete DOS) with no confidentiality or integrity consequence.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H is internally consistent and points to a genuinely low-barrier attack: network reachable, low complexity, no privileges, no user interaction, with impact confined entirely to availability (A:H, C:N/I:N). Oracle's own 'easily exploitable' language reinforces the low-complexity assessment. However, the practical priority is tempered by the absence of any confidentiality or integrity impact - this is a service-outage bug, not a breach vector - and by the product's limited deployment footprint. No EPSS probability was provided, no public exploit code has been identified, and the CVE is not listed in CISA KEV, so there is no evidence of active or widespread exploitation; risk today is theoretical but easy to realize if an attacker can reach the SDP HTTP interface. Net priority: elevated for organizations that expose SDP messaging endpoints to untrusted networks, lower where the platform sits behind carrier-internal segmentation.

An attacker with network reach to the SDP Messaging Enabler sends a specially crafted or malformed HTTP message request that the messaging path fails to handle, causing the platform to hang or crash and denying service to all downstream messaging consumers. Because no authentication, privileges, or user interaction are required and complexity is low, the request can be scripted and repeated to keep the service down. No public proof-of-concept has been identified at time of analysis.