What is the CVSS score of CVE-2026-60387?

CVE-2026-60387 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Service Delivery Platform are affected by CVE-2026-60387?

Oracle Fusion Middleware Service Delivery Platform (versions 12.2.1.4.0 and 14.1.2.0.0) contains a critical vulnerability allowing unauthenticated remote attackers to achieve complete system takeover…

How to fix or mitigate CVE-2026-60387?

Within 24 hours, inventory all systems running Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, assess network accessibility of T3 and IIOP protocol ports (typically 7002, 7003, 7102, 7103), and determine business criticality of affected systems. Within 7 days, implement network segmentation to restrict access to T3/IIOP ports from untrusted networks, enable protocol-level filtering at firewalls, deploy IDS/IPS signatures for WebLogic deserialization exploits, and implement detailed access logging and monitoring on affected systems. Within 30 days, engage Oracle support to assess available workarounds or interim releases, develop an upgrade path to a patched version when available, and establish a timeline for migrating to remediated versions based on business prioritization and vendor patch releases.

Oracle Service Delivery Platform CVE-2026-60387

EUVD-2026-46793 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-qf8p-3w7c-8xgf

Authentication Bypass Oracle Service Delivery Platform

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated, low-complexity network exploitation over T3/IIOP with no user interaction yielding full takeover justifies AV:N/AC:L/PR:N/UI:N and C/I/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:22 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Service Delivery Platform. Successful attacks of this vulnerability can result in takeover of Service Delivery Platform. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle Fusion Middleware's Service Delivery Platform (Messaging Enabler component) is possible by unauthenticated remote attackers reaching the T3 or IIOP protocols. Versions 12.2.1.4.0 and 14.1.2.0.0 are affected, and the CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) reflects complete loss of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, but the T3/IIOP attack surface is a historically abused deserialization vector on the underlying WebLogic stack, warranting priority patching.

Technical ContextAI

Service Delivery Platform is a communications/messaging enablement product built on the Oracle WebLogic Server layer of Oracle Fusion Middleware; the vulnerable Messaging Enabler is reached through WebLogic's proprietary T3 remote protocol and the CORBA-based IIOP protocol, both of which carry serialized Java objects. These protocols are the same channels historically implicated in WebLogic Java deserialization / remote-code-execution issues, where a crafted serialized payload sent to the RMI/T3 or IIOP listener is deserialized without adequate validation, yielding server-side execution or full instance compromise. No CWE was assigned by NVD, but the affected-protocol profile and 'takeover' impact are consistent with an unsafe-deserialization (CWE-502) class root cause; this should be treated as inferred, not vendor-confirmed.

RemediationAI

Apply the fixes from the Oracle Critical Patch Update of July 2026 (Patch available per vendor advisory - https://www.oracle.com/security-alerts/cpujul2026.html); Oracle CPU advisories do not publish a standalone semantic fix version, so apply the specific CPU patch mapped to your Service Delivery Platform 12.2.1.4.0 or 14.1.2.0.0 installation from the advisory's patch matrix rather than an invented version number. Until patched, reduce exposure of the T3 and IIOP listeners: restrict access to the WebLogic administration and RMI/IIOP ports to trusted management networks via firewall/ACLs, and use WebLogic connection filters (weblogic.security.net.ConnectionFilterImpl) to allow T3/T3S/IIOP only from known hosts - note this can break legitimate inter-server, JMS, or management clients that rely on T3/IIOP, so validate cluster and integration traffic first. Disabling IIOP where not required in the WebLogic protocol configuration further shrinks the attack surface at the cost of losing CORBA/EJB remote interoperability.