Service Delivery Platform CVE-2026-60440

Exploitation requires network access over HTTP to the Service Delivery Platform Messaging Enabler component and a low-privileged authenticated foothold (CVSS PR:L) - a valid but unprivileged account, token, or session on the platform; it does NOT require user interaction (UI:N) or high privileges. Attack complexity is low (AC:L), so no special timing or environmental conditions are needed once access exists. The practical limiting factors are: the attacker must first possess low-level credentials/session on an SDP instance, and the SDP HTTP interface must be reachable from the attacker's network position; instances exposed only on isolated management networks with no untrusted low-privilege accounts are substantially harder to reach. Affected deployments are limited to Service Delivery Platform 12.2.1.4.0 and 14.1.2.0.0.

The signals are moderately concerning but not top-tier. CVSS 3.1 base score is 7.7 (High) driven by AV:N/AC:L/PR:L/UI:N with a scope change and pure confidentiality impact - network reachable, low complexity, needs only low privileges and no user interaction, which favors an attacker. However, PR:L means it is authenticated exploitation (some valid low-privileged account or session is required), which limits opportunistic mass exploitation. No EPSS score was provided, so exploitation probability cannot be quantified from the input; there is no KEV listing and no evidence of a public POC, so this is currently a disclosed-and-patched issue rather than an actively exploited one. The confidentiality-only impact (I:N/A:N) means data exposure is the sole concrete risk - no tampering or service disruption - but the scope change materially raises the blast radius because exposed data can span beyond Service Delivery Platform itself. Net: a real patch priority for exposed, multi-tenant, or internet-adjacent SDP instances, but lower urgency than an unauthenticated RCE.

An attacker who holds or obtains a low-privileged account (or a valid session) on an internet- or partner-reachable Service Delivery Platform sends crafted HTTP requests to the Messaging Enabler component, abusing the authorization/authentication-bypass weakness to read messaging data and, via the scope change, data belonging to connected products. Because attack complexity is low and no user interaction is needed, exploitation is straightforward once network and low-privilege access exist, though no public exploit code has been identified at time of analysis.