Service Delivery Platform CVE-2026-60441

Exploitation requires network reachability to the Service Delivery Platform's WebLogic T3 or IIOP listener (typically TCP 7001) - the CVE explicitly names 'network access via T3, IIOP' as the required channel. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms no authentication, no user interaction, and low attack complexity against affected versions 12.2.1.4.0 and 14.1.2.0.0. The main limiting factor is exposure of the T3/IIOP ports: deployments that firewall these protocols to trusted management hosts or disable IIOP substantially reduce reachability, and only the two named supported versions of the Messaging Enabler component are in scope.

All available signals point to genuine high priority rather than an inflated score. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8 Critical) indicates remote, low-complexity, unauthenticated exploitation requiring no user interaction, and Oracle explicitly describes the outcome as full 'takeover' of the platform. No EPSS score was provided in the input, and the vulnerability is not in CISA KEV, so there is no evidence of active exploitation yet; likewise no POC was referenced, so the practical exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. The tag 'Information Disclosure' understates the vendor-stated full-compromise impact and appears to be a coarse categorization label rather than the true worst-case; treat the CVSS/description takeover claim as authoritative. Net: high real-world risk driven by pre-auth network reachability, tempered only by the current absence of a known public exploit.

An attacker who can reach the WebLogic T3 or IIOP listener (default port 7001) of a Service Delivery Platform Messaging Enabler instance sends a crafted serialized-object request over T3/IIOP with no credentials. Because the flaw is unauthenticated and low-complexity, the payload triggers server-side execution leading to full platform takeover with confidentiality, integrity, and availability compromise. No public POC was referenced in the input, but the attack requires only network line-of-sight to the affected port.