What is the CVSS score of CVE-2026-60386?

CVE-2026-60386 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Service Delivery Platform are affected by CVE-2026-60386?

Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler) versions 12.2.1.4.0 and 14.1.2.0.0 are vulnerable to complete remote system takeover by unauthenticated attackers over HTTP,…

How to fix or mitigate CVE-2026-60386?

Within 24 hours, identify and inventory all Oracle Service Delivery Platform instances running versions 12.2.1.4.0 or 14.1.2.0.0, immediately assess network exposure, and isolate or firewall any systems accessible from untrusted networks. Within 7 days, implement strict network segmentation to restrict Messaging Enabler component access to authorized users only, enable enhanced logging and monitoring of all access attempts, and apply available compensating controls including input validation hardening. Within 30 days, establish regular contact with Oracle support to track patch release timelines, develop an expedited patching and upgrade strategy for when fixes become available, and evaluate alternative solutions or product substitution if patching cannot be completed within risk tolerance thresholds.

Service Delivery Platform CVE-2026-60386

EUVD-2026-46792 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-g2w7-3mf3-r8qj

Authentication Bypass Oracle Service Delivery Platform

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle describes easily exploitable unauthenticated HTTP-based full takeover, so AV:N/AC:L/PR:N/UI:N with high C/I/A; scope unchanged as compromise stays within the SDP system.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:21 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Service Delivery Platform. Successful attacks of this vulnerability can result in takeover of Service Delivery Platform. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Complete takeover of Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) is achievable by remote unauthenticated attackers over HTTP, per Oracle's July 2026 Critical Patch Update. Affecting supported versions 12.2.1.4.0 and 14.1.2.0.0, the flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability and unauthenticated network reach make it a high-priority patching item.

Technical ContextAI

Service Delivery Platform (SDP) is part of the Oracle Communications / Fusion Middleware stack used by telecom operators to expose network services (messaging, presence, charging) to applications. The affected component, Messaging Enabler, handles messaging service integration and is reachable over HTTP. Oracle did not assign a CWE (listed N/A) and provided no root-cause class, but the 'takeover' outcome with full C/I/A impact over an unauthenticated HTTP vector is consistent with an injection, deserialization, or authentication-bypass class flaw typical of Java/Fusion Middleware exposed endpoints. Oracle's advisory-style scoring and the 'Information Disclosure' tag suggest sensitive data exposure is one facet of the broader compromise.

RemediationAI

Apply the fixes from Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); patch available per vendor advisory, though Oracle does not publish a discrete post-patch version string for SDP, so apply the CPU bundle appropriate to your 12.2.1.4.0 or 14.1.2.0.0 installation. Because the vector is unauthenticated HTTP against the Messaging Enabler, until patching is complete restrict network reachability of the SDP/Messaging Enabler HTTP endpoints to trusted management networks or place them behind an authenticating reverse proxy or WAF - trade-off is that legitimate downstream messaging integrations traversing those endpoints may break and must be allow-listed. Avoid exposing SDP directly to the internet. Oracle CPUs are cumulative, so the July 2026 update also carries prior fixes and should not be partially applied.