What is the CVSS score of CVE-2026-60441?

CVE-2026-60441 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Service Delivery Platform are affected by CVE-2026-60441?

Oracle Communications Service Delivery Platform (Messaging Enabler) in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 contains a critical flaw allowing remote unauthenticated attackers…

How to fix or mitigate CVE-2026-60441?

Within 24 hours: Conduct a definitive inventory of all systems running affected Oracle Fusion Middleware versions (12.2.1.4.0 and 14.1.2.0.0) with the Messaging Enabler component, and assess network accessibility of T3 and IIOP protocol ports. Within 7 days: Implement mandatory network segmentation to restrict T3 and IIOP protocol access to only authorized internal networks; disable these protocols at the perimeter if business operations permit; deploy enhanced logging on all Messaging Enabler instances for attack surface monitoring. Within 30 days: Establish a formal upgrade path to versions beyond 14.1.2.0.0 (per Oracle guidance on remediated versions) and develop an expedited migration timeline; maintain continuous monitoring of Oracle security advisories for patch availability and coordinate with Oracle support on interim fixes if available.

Service Delivery Platform CVE-2026-60441

EUVD-2026-46837 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-rh28-7c4h-mh8w

Authentication Bypass Oracle Service Delivery Platform

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network T3/IIOP access with low complexity and no user interaction yields PR:N/AV:N/AC:L; vendor-stated full takeover gives C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:50 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Service Delivery Platform. Successful attacks of this vulnerability can result in takeover of Service Delivery Platform. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle Communications Service Delivery Platform (Messaging Enabler component) in Oracle Fusion Middleware is achievable by a remote unauthenticated attacker over the T3 and IIOP protocols. Affecting versions 12.2.1.4.0 and 14.1.2.0.0, successful exploitation results in complete takeover of the platform with high confidentiality, integrity, and availability impact (CVSS 9.8). No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but the network-reachable, no-privilege attack profile makes it a high-priority patch.

Technical ContextAI

Service Delivery Platform is an Oracle Communications middleware product built on the Oracle WebLogic Server stack, and the affected surface is the T3 (WebLogic's proprietary RMI transport) and IIOP (CORBA-based) remote invocation protocols. These protocols carry serialized Java objects, and the WebLogic ecosystem has a long history of unsafe deserialization gadget chains reachable pre-authentication over exactly these ports (default 7001). The Messaging Enabler component is the affected module. No CWE was assigned in the input, but the T3/IIOP attack vector combined with unauthenticated remote code-level compromise is consistent with the Java deserialization (CWE-502) class that historically drives WebLogic 'takeover' advisories; this classification is inferred, not vendor-confirmed.

RemediationAI

Apply the fixes from the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); no discrete fixed version string was published in the input beyond the CPU bundle, so treat this as 'Patch available per vendor advisory' and apply the CPU patch corresponding to your 12.2.1.4.0 or 14.1.2.0.0 deployment. Because the attack traverses T3 and IIOP, the primary compensating control until patching is to restrict those protocols: configure WebLogic connection filters (weblogic.security.net.ConnectionFilterImpl) to allow T3/T3s/IIOP only from trusted management hosts, or disable IIOP on managed servers where it is not required - note this can break legacy RMI/CORBA clients and inter-domain calls that rely on those transports. Additionally, firewall the administrative listen port (default 7001) so it is not exposed to untrusted networks. These controls reduce reachability but are not a substitute for the CPU patch.