Service Delivery Platform CVE-2026-60386

Exploitation requires only network HTTP reachability to the Oracle Service Delivery Platform Messaging Enabler component on supported versions 12.2.1.4.0 or 14.1.2.0.0 - no authentication, no user interaction, and no special product configuration are stated as prerequisites (AV:N/AC:L/PR:N/UI:N). No special conditions beyond reaching the Messaging Enabler HTTP endpoint. The primary limiting factor is exposure: SDP is a telecom operator platform typically deployed on internal or carrier networks rather than the public internet, so realistic risk depends on whether the vulnerable HTTP interface is reachable from an attacker's position. The specific vulnerable feature within Messaging Enabler is not detailed by Oracle.

All CVSS signals point to maximum severity and low friction: AV:N/AC:L/PR:N/UI:N means remote, low-complexity, unauthenticated, no user interaction, and Oracle explicitly calls it 'easily exploitable' with 'takeover' as the outcome. However, exploitation-probability signals are absent - there is no EPSS score, no POC, and no CISA KEV listing provided, so real-world exploitation is not confirmed and appears theoretical at this time. The tension to note: the raw CVSS 9.8 argues for urgent action, while the lack of any exploitation evidence and the product's niche telecom footprint suggest current active-attack risk is lower than the score alone implies. No SSVC decision data was provided. Net: treat as high-priority to patch due to unauthenticated takeover potential, while recognizing exploitation in the wild is not yet demonstrated.

An attacker who can reach the Service Delivery Platform's Messaging Enabler HTTP interface sends a crafted request that, without any credentials, triggers the flaw and yields full control of the SDP instance. Given AC:L and PR:N, no special timing, user interaction, or prior access is needed. No public POC was identified, so an attacker would need to develop the exploit independently.