What is the CVSS score of CVE-2026-60384?

CVE-2026-60384 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Service Delivery Platform are affected by CVE-2026-60384?

Oracle Communications Service Delivery Platform (SDP) versions 12.2.1.4.0 and 14.1.2.0.0, commonly deployed within Oracle Fusion Middleware, contain a critical remote vulnerability that permits…

How to fix or mitigate CVE-2026-60384?

Within 24 hours: Identify all instances of SDP 12.2.1.4.0 and 14.1.2.0.0 in your Oracle Fusion Middleware environment and document their criticality and connectivity. Restrict network access to T3 and IIOP protocol ports exposed by WebLogic Messaging Enabler to only trusted sources, and disable these protocols if operationally feasible. Within 7 days: Implement enhanced monitoring and logging on affected systems for anomalous T3/IIOP connection attempts and unauthorized access patterns. Contact Oracle support to confirm patch timeline and availability. Within 30 days: Develop and execute an upgrade strategy to move SDP instances to patched versions as they become available, or plan migration to supported alternatives if patch timelines exceed your risk tolerance.

Oracle Service Delivery Platform CVE-2026-60384

EUVD-2026-46790 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-gh46-h4gw-7ffj

Authentication Bypass Oracle Service Delivery Platform

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network attack over T3/IIOP with no user interaction and low complexity yields full takeover, so AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:21 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Service Delivery Platform. Successful attacks of this vulnerability can result in takeover of Service Delivery Platform. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Complete takeover of Oracle Communications Service Delivery Platform (SDP) 12.2.1.4.0 and 14.1.2.0.0, shipped within Oracle Fusion Middleware, is achievable by a remote unauthenticated attacker reaching the T3 or IIOP protocols exposed by the underlying WebLogic Server (Messaging Enabler component). Rated CVSS 3.1 9.8 with full confidentiality, integrity and availability impact, this was disclosed in the Oracle July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Service Delivery Platform is Oracle's carrier-grade telecom middleware for exposing and orchestrating network services, deployed on top of Oracle WebLogic Server as part of Fusion Middleware. The exposed T3 (WebLogic's proprietary RMI transport) and IIOP (CORBA) protocols are the same remote entry points historically abused in WebLogic deserialization RCE chains, where crafted serialized Java objects sent to the listen port are deserialized without adequate validation. Oracle did not assign a CWE (listed N/A), but the T3/IIOP + full-takeover pattern is consistent with unsafe deserialization of untrusted data (CWE-502) or a related remote object/authentication weakness in the Messaging Enabler component. Note the Oracle tag labels this 'Information Disclosure,' which conflicts with the description's 'takeover' language - see risk assessment.

RemediationAI

Apply the fixes shipped in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) for the affected Service Delivery Platform 12.2.1.4.0 and 14.1.2.0.0 releases; Oracle's CPU model bundles the exact patch numbers per product line, so consult the advisory for the specific patch ID matching your installation, as no standalone fixed version string is given in this input. Because the attack surface is the WebLogic T3 and IIOP listeners, the strongest compensating control until patching is to disable T3/IIOP where not required or restrict them with a WebLogic connection filter (weblogic.security.net.ConnectionFilterImpl) allowing only trusted management hosts - trade-off: this can break inter-cluster RMI, JMS, and admin tooling that rely on T3/IIOP, so test in staging. Additionally, block external access to the WebLogic listen ports (default 7001/7002 and any IIOP ports) at the network firewall and place the SDP admin/management interfaces behind a segmented management network. These controls reduce reachability but do not remove the underlying flaw, so treat them as interim only.