Oracle Service Delivery Platform CVE-2026-60385

Exploitation requires network reachability to the Oracle WebLogic T3 or IIOP protocol listener fronting Service Delivery Platform's Messaging Enabler component on version 12.2.1.4.0 or 14.1.2.0.0 - no authentication, user interaction, or special product configuration is needed (AV:N/AC:L/PR:N/UI:N). The practical limiting factor is exposure of the T3/IIOP ports: deployments that firewall or segment these management protocols away from untrusted networks are not remotely exploitable by outside attackers, so the realistic risk concentrates on instances where T3/IIOP is reachable from an untrusted network.

The signals point to a genuine high priority, though real-world exposure depends on network reachability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) indicates trivial, unauthenticated, low-complexity network exploitation with full impact - the worst-case profile. No EPSS score, no KEV listing, and no POC were supplied, so probabilistic and active-exploitation evidence is absent; this suggests it is not yet known to be exploited in the wild despite the critical score. The main mitigating factor is architectural: T3 and IIOP are internal management/invocation protocols that mature deployments should not expose to untrusted networks, so effective risk is far higher for instances with Internet- or broadly-reachable T3/IIOP ports than for properly segmented ones. Note the tag 'Information Disclosure' understates the described impact - Oracle explicitly states full 'takeover,' so treat this as a compromise-grade issue, not merely disclosure.

An attacker who can reach the WebLogic T3 or IIOP port of an SDP instance sends a crafted remote invocation (e.g., a malicious serialized Java object) to the Messaging Enabler component without any credentials. Successful processing yields full takeover of the Service Delivery Platform, giving the attacker control over its data and services. No public POC was identified at time of analysis, but the low-complexity unauthenticated vector makes reliable exploitation plausible once technical details circulate.