What is the CVSS score of CVE-2026-60389?

CVE-2026-60389 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Service Delivery Platform are affected by CVE-2026-60389?

Organizations running Oracle Service Delivery Platform versions 12.2.1.4.0 or 14.1.2.0.0 face immediate risk of complete system compromise via unauthenticated remote attack over standard network…

How to fix or mitigate CVE-2026-60389?

Within 24 hours: inventory all Oracle Fusion Middleware instances running Service Delivery Platform versions 12.2.1.4.0 or 14.1.2.0.0 and assess their network accessibility. Within 7 days: restrict HTTP/HTTPS access to the Messaging Enabler component using network-level controls (firewall rules, WAF, or segmentation) to limit exposure to authorized endpoints only, enable detailed logging on affected systems, and verify backup integrity and recoverability. Within 30 days: monitor Oracle Critical Patch Update advisories and CISA KEV for patch releases, establish upgrade planning to migrate to patched versions immediately upon availability, and validate compensating controls effectiveness.

Service Delivery Platform CVE-2026-60389

EUVD-2026-46795 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-3448-47qf-j546

Authentication Bypass Oracle Service Delivery Platform

10.0

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

10.0 CRITICAL

Description confirms unauthenticated HTTP-reachable full takeover with cross-product impact, so AV:N/AC:L/PR:N/UI:N, scope change S:C, and complete C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:23 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 10.0

DescriptionCVE.org

Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Service Delivery Platform. While the vulnerability is in Service Delivery Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Service Delivery Platform. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Complete remote takeover of Oracle Service Delivery Platform (a component of Oracle Fusion Middleware, versions 12.2.1.4.0 and 14.1.2.0.0) is possible via the Messaging Enabler component, reachable over HTTP by an unauthenticated attacker. The flaw carries a maximum CVSS 3.1 base score of 10.0 with a scope change, meaning successful exploitation not only fully compromises the platform's confidentiality, integrity, and availability but can also significantly impact other connected products. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability (AV:N/AC:L/PR:N/UI:N) makes it a top-priority patch from the Oracle July 2026 Critical Patch Update.

Technical ContextAI

Oracle Service Delivery Platform (SDP) is a telecommunications/service-provider middleware layer within Oracle Fusion Middleware used to expose and orchestrate network services, messaging, and third-party application access to carrier infrastructure. The vulnerable Messaging Enabler component handles messaging-oriented service delivery and is exposed over HTTP. No CWE was assigned in the source data, so the precise root-cause class (e.g., injection, deserialization, or authentication bypass) cannot be confirmed; however, the combination of unauthenticated network access, low complexity, and a scope change to full host/adjacent-product takeover is characteristic of injection or unsafe request-handling flaws in an exposed HTTP endpoint. The scope change (S:C) indicates the vulnerable component can pivot beyond its own security authority into other products it integrates with.

RemediationAI

Apply the patch delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) - this is patch available per vendor advisory, though Oracle does not publish a discrete fixed build number, so administrators must apply the CPU patch set corresponding to their installed release (12.2.1.4.0 or 14.1.2.0.0). Because no exact fix version was provided in the input data, verify the specific patch identifier for your deployment directly in the CPU advisory's Fusion Middleware patch availability matrix. Until patching is complete, reduce exposure by restricting network access to the Service Delivery Platform's HTTP interface and Messaging Enabler endpoint to trusted management networks only (via firewall or reverse-proxy allowlisting), which mitigates the network attack vector but may disrupt legitimate integrations that rely on that endpoint; also monitor HTTP logs on the Messaging Enabler for anomalous requests. Given the scope change, segment SDP from adjacent Oracle products to limit lateral impact.