EUVD-2026-46794
GHSA-6xc2-chqh-rqm7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed WebLogic T3/IIOP listener
-
DeliverySend crafted malicious RMI/IIOP request
-
ExploitTrigger flaw in Messaging Enabler
-
ExecutionExecute attacker-controlled logic unauthenticated
-
ImpactFull takeover of Service Delivery Platform
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the Oracle WebLogic T3 or IIOP protocol listeners fronting the Service Delivery Platform (default WebLogic ports 7001/7002), targeting the Messaging Enabler component on versions 12.2.1.4.0 or 14.1.2.0.0 - the CVSS vector is AV:N/AC:L/PR:N/UI:N, so no authentication and no user interaction are needed against a reachable instance. The principal limiting factor is that T3/IIOP are non-HTTP administrative/RMI protocols that are frequently firewalled off from untrusted networks; deployments that do not expose these ports to attacker-reachable networks are not remotely exploitable, so real-world risk hinges on whether the T3/IIOP listeners are exposed beyond a trusted management segment. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) indicates the worst-case profile: remote, low-complexity, unauthenticated, full triad impact - a genuine top-priority patch. However, exploitation is gated on network reachability of the T3/IIOP ports, which in well-segmented deployments are not exposed to untrusted networks; this materially lowers real-world exposure versus an HTTP-facing flaw despite the identical CVSS. No EPSS score, KEV listing, or POC was provided, so exploitation probability cannot be quantified from the input and there is no public exploit identified at time of analysis. The signals are not conflicting but are incomplete: severity is confirmed critical by Oracle, yet no SSVC, EPSS, or exploitation telemetry is available to distinguish theoretical from imminent risk. Given WebLogic T3/IIOP's strong historical track record of weaponized deserialization exploits, this should be treated as high priority even absent current exploitation evidence. |
| Exploit ScenarioDerived | An attacker who can reach the WebLogic T3 or IIOP listener sends a crafted malicious request (consistent with WebLogic RMI/deserialization abuse) to the Messaging Enabler component without any credentials, and because complexity is low and no user interaction is needed, gains full control of the Service Delivery Platform instance. No public exploit is identified at time of analysis, but the low-complexity unauthenticated profile means reliable exploitation is plausible once tooling emerges. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Complete takeover of Oracle Service Delivery Platform (a Fusion Middleware component) is possible when unauthenticated attackers reach the T3 or IIOP protocols exposed by the underlying WebLogic server, per Oracle's July 2026 Critical Patch Update. The Messaging Enabler component in versions 12.2.1.4.0 and 14.1.2.0.0 can be fully compromised (confidentiality, integrity, and availability), earning a CVSS 9.8. No public exploit has been identified at time of analysis, but the T3/IIOP attack surface has a long history of critical WebLogic deserialization exploitation.
RemediationAI
Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the primary and only vendor-sanctioned remediation for both affected versions 12.2.1.4.0 and 14.1.2.0.0; Patch available per vendor advisory, though the input does not provide a discrete patched build number to cite. Because the attack requires reaching the T3 and IIOP protocols, the strongest compensating control is to restrict those protocols: use WebLogic connection filters (weblogic.security.net.ConnectionFilterImpl) to allow T3/T3S/IIOP only from trusted management hosts, and block the WebLogic listen ports (default 7001/7002) at the network firewall from all untrusted segments - the trade-off is that legitimate remote T3/IIOP clients and inter-cluster traffic must be explicitly allowlisted or they will break. Where T3/IIOP are not required by the application, disabling the IIOP protocol on the server's listen ports removes the vector entirely at the cost of CORBA interoperability. These controls reduce exposure but are not a substitute for the CPU patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Service Delivery Platform is an Oracle Fusion Middleware telecom/communications product that runs atop Oracle WebLogic Server, and the vulnerability sits in its Messaging Enabler component. The named attack vectors - T3 and IIOP - are WebLogic's proprietary remote invocation protocols (T3 is WebLogic's native RMI transport; IIOP is the CORBA interoperability protocol), which have historically been the delivery channel for Java deserialization flaws in WebLogic. Oracle does not assign a CWE for this entry, but the pattern (unauthenticated remote takeover reachable only via T3/IIOP) is characteristic of insecure deserialization of untrusted data (CWE-502) in the WebLogic RMI stack, though the exact root cause is not confirmed in the available data.
Know when Service Delivery Platform gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated low-complexity remote access via T3/IIOP yields AV:N/AC:L/PR:N/UI:N, and vendor-stated full product takeover justifies C:H/I:H/A:H with no scope change.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Service Delivery Platform. Successful attacks of this vulnerability can result in takeover of Service Delivery Platform. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Service Delivery Platform versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical vulnerability allowing complete remote takeover via unauthenticated WebLogic protocol exploitation; no public exploit identified at time of analysis, but the T3/IIOP attack surface has documented history of critical deserialization flaws. Organizations running these Fusion Middleware components face immediate risk of production compromise with no available vendor patch. Immediate network isolation and protocol hardening are required to prevent exploitation.
Restrict network access to WebLogic T3 and IIOP ports at the firewall; disable these protocols if not required for business operations; implement network segmentation isolating affected Service Delivery Platform instances; deploy intrusion detection signatures for WebLogic deserialization exploits; enable detailed logging of T3 and IIOP protocol activity for forensic monitoring; increase monitoring frequency for suspicious authentication attempts and protocol anomalies. No vendor-released patch identified at time of analysis.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Service Delivery Platform
View allComplete remote takeover of Oracle Service Delivery Platform (a component of Oracle Fusion Middleware, versions 12.2.1.4
Complete takeover of Oracle Service Delivery Platform is achievable by an unauthenticated remote attacker via SOAP reque
Privilege-abusing remote compromise in Oracle Communications Service Delivery Platform (Messaging Enabler component), ve
Full system takeover in Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) versions 12.2.
Complete takeover of Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) is possible by an
Complete takeover of Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) is achievable by
Complete takeover of Oracle Service Delivery Platform (part of Oracle Fusion Middleware) is possible via its Messaging E
Complete takeover of Oracle Communications Service Delivery Platform (SDP) 12.2.1.4.0 and 14.1.2.0.0, shipped within Ora
Full compromise of Oracle Communications Service Delivery Platform (Messaging Enabler component) versions 12.2.1.4.0 and
Complete takeover of Oracle Communications/Fusion Middleware Service Delivery Platform (versions 12.2.1.4.0 and 14.1.2.0
Complete takeover of Oracle Communications Service Delivery Platform (Messaging Enabler component) versions 12.2.1.4.0 a
Full compromise of Oracle Communications Service Delivery Platform (Messaging Enabler component) in Oracle Fusion Middle
Exploit-DB