Oracle Service Delivery Platform CVE-2026-60387

Exploitation requires network access to the Service Delivery Platform's WebLogic T3 and/or IIOP listener ports, which must be reachable from the attacker; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication and no user interaction are needed against affected versions 12.2.1.4.0 and 14.1.2.0.0. The primary limiting factor is network exposure of the T3/IIOP protocols - deployments that firewall these ports to trusted management segments or disable IIOP are not remotely reachable by arbitrary attackers, substantially lowering realistic risk even though the raw CVSS score is 9.8. Only the two named supported versions are confirmed affected.

This is a genuine high-priority issue rather than an inflated high-CVSS score: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) indicates network-reachable, low-complexity, unauthenticated exploitation with no user interaction and total system impact, and Oracle explicitly labels it 'easily exploitable' resulting in 'takeover.' No EPSS score, KEV entry, POC, or SSVC decision data was supplied, so exploitation probability and active-exploitation status cannot be quantified - this means the risk rests on the CVSS profile and Oracle's own characterization, not on observed exploitation. The vendor 'Information Disclosure' tag understates the impact relative to the full C/I/A-high vector and 'takeover' language, so defenders should weight the CVSS vector and Oracle description over the tag. Because T3/IIOP are frequently exposed on WebLogic-based deployments and are a repeat target, real-world risk should be treated as high pending patching even though no exploit is yet public.

An attacker with network reachability to the Service Delivery Platform's WebLogic T3 or IIOP listener sends a crafted request to the Messaging Enabler component without any credentials or user interaction. Given the low-complexity, unauthenticated vector, a single malicious payload can escalate to full takeover of the platform instance. No public exploit is identified at time of analysis, though the T3/IIOP surface has well-documented prior tooling.