What is the CVSS score of CVE-2026-60440?

CVE-2026-60440 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Service Delivery Platform are affected by CVE-2026-60440?

Oracle Service Delivery Platform (Messaging Enabler) versions 12.2.1.4.0 and 14.1.2.0.0 contain an authentication bypass enabling low-privileged users to access sensitive data across the platform and…

How to fix or mitigate CVE-2026-60440?

Within 24 hours, inventory all Oracle Service Delivery Platform deployments running versions 12.2.1.4.0 or 14.1.2.0.0 and assess network exposure; immediately restrict network access to these systems to necessary authenticated accounts only. Within 7 days, implement enforced access controls limiting Messaging Enabler functions to privileged administrators and enable detailed audit logging on all data access and authentication attempts. Within 30 days, contact Oracle support for patch availability timelines and evaluate interim mitigation strategies including network segmentation, deployment in air-gapped environments if operationally feasible, or migration to patched versions when released.

Service Delivery Platform CVE-2026-60440

EUVD-2026-46836 HIGH

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-55cp-rp94-jc3r

Authentication Bypass Information Disclosure Oracle Service Delivery Platform

7.7

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

7.7 HIGH

Network HTTP reach with low complexity and a required low-privilege account gives AV:N/AC:L/PR:L; authorization bypass yields data disclosure only (C:H, I:N, A:N) with a boundary-crossing scope change (S:C).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:50 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 7.7

DescriptionCVE.org

Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Service Delivery Platform. While the vulnerability is in Service Delivery Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Service Delivery Platform accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

AnalysisAI

Information disclosure with scope change in Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged remote attacker read all data accessible to the platform and impact additional connected products. The flaw is network-exploitable over HTTP with low attack complexity and only minimal existing privileges, and Oracle tags it as an authentication bypass affecting confidentiality only (no integrity or availability impact). No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low exploitation barrier and cross-boundary scope change make it a meaningful risk in exposed telecom/messaging deployments.

Technical ContextAI

Oracle Service Delivery Platform is a carrier-grade Fusion Middleware layer that exposes converged telecom/messaging services (SMS, MMS, presence, notifications) to applications, and the affected component is the Messaging Enabler that brokers those messaging flows. The CVSS scope change (S:C) indicates the vulnerability lets an attacker cross the security boundary of the Messaging Enabler to reach data governed by other components or downstream products, consistent with Oracle's own note that attacks 'may significantly impact additional products.' Oracle's 'Authentication Bypass' tag combined with C:H/I:N/A:N points to a broken access-control / authorization root cause (an authenticated but low-privileged principal obtaining data it should not see) rather than a memory-safety or injection defect. No CWE was assigned in the source data, so the exact weakness class is inferred from the vector and vendor tag rather than confirmed by a formal classification.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (Patch available per vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html) to both affected releases, 12.2.1.4.0 and 14.1.2.0.0; the input does not name a discrete fixed build number, so obtain the exact patch set from the CPU matrix rather than assuming a version string. Until patching completes, reduce exposure by restricting network reachability of the Messaging Enabler and Service Delivery Platform HTTP endpoints to trusted management networks or behind a VPN/reverse proxy with strict allow-listing (trade-off: may break legitimate partner or application integrations that call the messaging APIs), tightening authorization so low-privileged accounts cannot reach messaging functions, and reviewing/rotating credentials for low-privilege service accounts that could be abused. Increase monitoring of SDP messaging access logs for anomalous cross-tenant or bulk data reads given the scope-change nature of the flaw.