Service Delivery Platform CVE-2026-60383

Exploitation requires the attacker to already have a low-privileged logon to the infrastructure where Service Delivery Platform executes (CVSS PR:L, AV:L) and to interact with the Messaging Enabler component of SDP 12.2.1.4.0 or 14.1.2.0.0 - it is not remotely reachable without a prior foothold or valid local credentials. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once local access exists the bar is low. Limiting factors: the local attack vector and the authenticated low-privilege prerequisite confine this to insiders or attackers who have already compromised an account on the SDP host, and only the two named Oracle Communications versions are in scope. The scope change (S:C) means impact is not confined to SDP and may extend to additional products sharing the environment.

The CVSS 3.1 base score is 8.4 (High) with vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N: the attack vector is LOCAL and requires an existing low-privilege login, which meaningfully limits reach compared to a network-facing bug, but complexity is low, no user interaction is needed, and the scope change plus High confidentiality and integrity impacts drive the score up. No EPSS probability was provided, this CVE is not listed in CISA KEV, and no POC or public exploit was identified, so all real-world exploitation signals are currently absent - this reads as a high-CVSS issue whose practical risk is gated by the prerequisite of local authenticated access. The Authentication Bypass tag and the description's local-logon requirement are consistent (both imply an insider or a foothold on the host), so no signals conflict; the main missing data are EPSS, SSVC, and any exploit-maturity indicator.

An attacker who already holds a low-privilege account on a host where Service Delivery Platform runs - for example a limited operator login or a compromised low-tier service account - authenticates locally and abuses the Messaging Enabler's authorization gap to read and tamper with all SDP-accessible data. Because the vulnerability crosses a scope boundary, the same access can be leveraged to impact connected Oracle products, not just SDP. No public exploit code has been identified, so an attacker would need to develop the technique independently.