EUVD-2026-46795
GHSA-3448-47qf-j546
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed SDP HTTP endpoint
-
DeliverySend crafted request to Messaging Enabler
-
ExploitTrigger unauthenticated flaw
-
ExecutionGain full platform control
-
PersistPivot to integrated products (scope change)
-
ImpactExfiltrate data or disrupt service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation over HTTP against affected Oracle Service Delivery Platform deployments (versions 12.2.1.4.0 and 14.1.2.0.0) running the Messaging Enabler component. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication, no user interaction, and low attack complexity are required. The primary limiting factor is network reachability of the Service Delivery Platform HTTP endpoint: deployments that expose the Messaging Enabler only on isolated carrier/management networks materially reduce exposure, whereas any internet- or partner-facing exposure is directly exploitable. Exploitation is also constrained to the two named supported versions. |
| Impact | All available severity signals point to maximum real-world risk: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) yields a perfect 10.0, meaning remote, unauthenticated, low-complexity exploitation with full CIA impact and cross-product scope change. However, exploitation-likelihood signals are missing or absent: no EPSS score was provided, the CVE is not in CISA KEV (no confirmed active exploitation), and no public proof-of-concept was identified. This creates a common tension - the flaw is maximally severe in impact terms but has no evidence yet of exploitation in the wild, which is typical for freshly disclosed Oracle CPU vulnerabilities where technical details are withheld. The correct posture is to treat it as an urgent patch priority based on impact and trivial exploitability rather than waiting for exploitation evidence; the withheld CWE and the fact that details come only from Oracle's advisory mean the exact attack mechanics remain unverified. |
| Exploit ScenarioDerived | An unauthenticated attacker who can reach the Service Delivery Platform's HTTP interface sends a crafted request to the Messaging Enabler component and, exploiting the flaw with low complexity, gains full control of the platform. Because of the scope change, the attacker can then pivot to impact additional integrated products, exfiltrate messaging data, alter service delivery, or take the platform offline. No public proof-of-concept is currently known, but the trivial preconditions make weaponization straightforward once details or a POC emerge. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Complete remote takeover of Oracle Service Delivery Platform (a component of Oracle Fusion Middleware, versions 12.2.1.4.0 and 14.1.2.0.0) is possible via the Messaging Enabler component, reachable over HTTP by an unauthenticated attacker. The flaw carries a maximum CVSS 3.1 base score of 10.0 with a scope change, meaning successful exploitation not only fully compromises the platform's confidentiality, integrity, and availability but can also significantly impact other connected products. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability (AV:N/AC:L/PR:N/UI:N) makes it a top-priority patch from the Oracle July 2026 Critical Patch Update.
RemediationAI
Apply the patch delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) - this is patch available per vendor advisory, though Oracle does not publish a discrete fixed build number, so administrators must apply the CPU patch set corresponding to their installed release (12.2.1.4.0 or 14.1.2.0.0). Because no exact fix version was provided in the input data, verify the specific patch identifier for your deployment directly in the CPU advisory's Fusion Middleware patch availability matrix. Until patching is complete, reduce exposure by restricting network access to the Service Delivery Platform's HTTP interface and Messaging Enabler endpoint to trusted management networks only (via firewall or reverse-proxy allowlisting), which mitigates the network attack vector but may disrupt legitimate integrations that rely on that endpoint; also monitor HTTP logs on the Messaging Enabler for anomalous requests. Given the scope change, segment SDP from adjacent Oracle products to limit lateral impact.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Service Delivery Platform (SDP) is a telecommunications/service-provider middleware layer within Oracle Fusion Middleware used to expose and orchestrate network services, messaging, and third-party application access to carrier infrastructure. The vulnerable Messaging Enabler component handles messaging-oriented service delivery and is exposed over HTTP. No CWE was assigned in the source data, so the precise root-cause class (e.g., injection, deserialization, or authentication bypass) cannot be confirmed; however, the combination of unauthenticated network access, low complexity, and a scope change to full host/adjacent-product takeover is characteristic of injection or unsafe request-handling flaws in an exposed HTTP endpoint. The scope change (S:C) indicates the vulnerable component can pivot beyond its own security authority into other products it integrates with.
Know when Service Delivery Platform gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Description confirms unauthenticated HTTP-reachable full takeover with cross-product impact, so AV:N/AC:L/PR:N/UI:N, scope change S:C, and complete C:H/I:H/A:H.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Service Delivery Platform. While the vulnerability is in Service Delivery Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Service Delivery Platform. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
Executive ViewAI
Organizations running Oracle Service Delivery Platform versions 12.2.1.4.0 or 14.1.2.0.0 face immediate risk of complete system compromise via unauthenticated remote attack over standard network connections; successful exploitation enables attackers to steal data, disrupt business operations, and potentially access connected systems without credentials or user interaction required.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) restrict network access to the Messaging Enabler component via firewall rules or WAF policies to reduce attack surface; (2) implement enhanced monitoring and alerting for suspicious connection attempts and anomalous behavior on affected systems; (3) isolate affected Service Delivery Platform instances from business-critical systems where operationally feasible; (4) maintain and regularly test backup and recovery procedures; (5) establish continuous monitoring of Oracle advisories and CISA KEV for patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Service Delivery Platform
View allComplete takeover of Oracle Service Delivery Platform is achievable by an unauthenticated remote attacker via SOAP reque
Privilege-abusing remote compromise in Oracle Communications Service Delivery Platform (Messaging Enabler component), ve
Full system takeover in Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) versions 12.2.
Complete takeover of Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) is possible by an
Complete takeover of Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) is achievable by
Complete takeover of Oracle Service Delivery Platform (part of Oracle Fusion Middleware) is possible via its Messaging E
Complete takeover of Oracle Communications Service Delivery Platform (SDP) 12.2.1.4.0 and 14.1.2.0.0, shipped within Ora
Full compromise of Oracle Communications Service Delivery Platform (Messaging Enabler component) versions 12.2.1.4.0 and
Complete takeover of Oracle Communications/Fusion Middleware Service Delivery Platform (versions 12.2.1.4.0 and 14.1.2.0
Complete takeover of Oracle Communications Service Delivery Platform (Messaging Enabler component) versions 12.2.1.4.0 a
Full compromise of Oracle Communications Service Delivery Platform (Messaging Enabler component) in Oracle Fusion Middle
Complete takeover of Oracle Service Delivery Platform (a Fusion Middleware component) is possible when unauthenticated a
Exploit-DB