What is the CVSS score of CVE-2026-60385?

CVE-2026-60385 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Service Delivery Platform are affected by CVE-2026-60385?

Oracle Service Delivery Platform (Oracle Fusion Middleware) versions 12.2.1.4.0 and 14.1.2.0.0 are vulnerable to complete remote takeover by unauthenticated attackers accessing the messaging…

How to fix or mitigate CVE-2026-60385?

Within 24 hours, identify all systems running Oracle Service Delivery Platform versions 12.2.1.4.0 or 14.1.2.0.0, immediately restrict network access to T3 and IIOP protocol ports from external networks, and assess whether any internet-facing instances exist. Within 7 days, apply the Oracle Critical Patch Update released in July 2026 to all affected systems after validation in non-production environments. Within 30 days, verify successful patch deployment across the entire Oracle Fusion Middleware infrastructure, conduct a security assessment to detect any signs of compromise, and implement continuous monitoring for suspicious connection attempts on T3/IIOP ports.

Oracle Service Delivery Platform CVE-2026-60385

EUVD-2026-46791 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-w5j5-hhmq-6764

Authentication Bypass Oracle Service Delivery Platform

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated, low-complexity remote exploitation over T3/IIOP with described full takeover justifies AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H; no cross-system scope change, so S:U.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:21 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Service Delivery Platform. Successful attacks of this vulnerability can result in takeover of Service Delivery Platform. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Complete takeover of Oracle Service Delivery Platform (part of Oracle Fusion Middleware) is possible via its Messaging Enabler component, affecting versions 12.2.1.4.0 and 14.1.2.0.0. A remote, unauthenticated attacker reaching the T3 or IIOP protocol ports can fully compromise the platform (full confidentiality, integrity, and availability loss, CVSS 9.8). This was fixed in the Oracle Critical Patch Update of July 2026; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle Service Delivery Platform (SDP) is a Fusion Middleware telecom/messaging enablement layer that runs on Oracle WebLogic Server, and the affected 'Messaging Enabler' component handles messaging services. The exposed attack surface is WebLogic's T3 (proprietary Java RMI protocol) and IIOP (CORBA/RMI-over-IIOP) remote invocation channels, which have a long history of Java deserialization abuse leading to remote code execution. No CWE was assigned in the input, but the T3/IIOP vector combined with full 'takeover' impact is consistent with the unsafe-deserialization / untrusted remote object invocation class of flaws typical of WebLogic-hosted products. Exact CPE strings were not provided; affected products are identified only by Oracle/EUVD version labels (SDP 12.2.1.4.0 and 14.1.2.0.0).

RemediationAI

Apply the fixes from the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) for the affected Service Delivery Platform 12.2.1.4.0 and 14.1.2.0.0 releases; Oracle publishes the exact patch/bundle identifiers per product in that advisory, so the CPU patch is the primary and required remediation (no standalone fixed version string was given in this input, so cite the CPU rather than inventing a version). As compensating controls until patching, restrict network access to the WebLogic T3 and IIOP listen ports using WebLogic connection filters (weblogic.security.net.ConnectionFilterImpl) or a firewall so only trusted management hosts can reach them, and disable IIOP and/or the default T3 channel if the deployment does not require them - trade-off: this can break legitimate remote EJB/JMS clients and inter-server communication, so validate against your integration dependencies first. Place SDP behind network segmentation so T3/IIOP is never exposed to untrusted or Internet-facing networks.