What is the CVSS score of CVE-2026-60501?

CVE-2026-60501 has a CVSS 3.1 base score of 5.2 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Service Delivery Platform CVE-2026-60501

EUVD-2026-46878 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-6j24-gwh2-8qx7

Authentication Bypass Oracle Service Delivery Platform

5.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.2 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.2 MEDIUM

Consistent with provided vector: local access with low privileges required, scope change to adjacent products, partial confidentiality and integrity impact, no availability impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 09:14 vuln.today

DescriptionCVE.org

Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Service Delivery Platform executes to compromise Service Delivery Platform. While the vulnerability is in Service Delivery Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Service Delivery Platform accessible data as well as unauthorized read access to a subset of Service Delivery Platform accessible data. CVSS 3.1 Base Score 5.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N).

AnalysisAI

Oracle Service Delivery Platform's Messaging Enabler component in versions 12.2.1.4.0 and 14.1.2.0.0 allows low-privileged local users to perform unauthorized read and write operations on platform data, with a documented scope change that extends impact to additional co-deployed Oracle Fusion Middleware products. The vulnerability requires only a low-privileged local account on the hosting infrastructure, making insider threats and compromised service accounts the primary risk vector. No public exploit has been identified at time of analysis; this was disclosed as part of Oracle's July 2026 Critical Patch Update.

Technical ContextAI

Oracle Service Delivery Platform (SDP) is a component of Oracle Fusion Middleware designed for telecommunications and messaging enablement. The vulnerable component, Messaging Enabler, handles message routing and delivery within the platform. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) reveals a local privilege-boundary flaw: an attacker operating with only low-level OS or infrastructure credentials can interact with the Messaging Enabler in a way that bypasses intended access controls. The scope change (S:C) is technically significant - it indicates the authorization failure propagates beyond the SDP process boundary and can affect other Fusion Middleware products sharing the same infrastructure. No CWE identifier was provided by the reporter, but the 'Authentication Bypass' tag in the ENISA EUVD entry (EUVD-2026-46878) suggests the root cause is an authorization enforcement failure rather than a cryptographic or session management flaw - the attacker is authenticated but able to exceed their permitted data access boundary.

RemediationAI

Organizations should apply Oracle's July 2026 Critical Patch Update patches for Service Delivery Platform - the exact patched release version is not independently confirmed from the available references, and Oracle's advisory at https://www.oracle.com/security-alerts/cpujul2026.html should be consulted for the specific fix version and patch installation instructions. Where immediate patching is not feasible, restrict local logon access to the infrastructure hosting Service Delivery Platform to the minimum required accounts, removing any non-essential user or service account OS-level access; this directly addresses the AV:L prerequisite and eliminates most attacker scenarios. Additionally, audit and tighten Messaging Enabler-specific access controls within the SDP configuration to enforce least-privilege on accounts that must retain access. Enable and monitor SDP and Fusion Middleware access logs for anomalous data read or modification patterns in the Messaging Enabler component. These compensating controls reduce exposure but do not remediate the underlying authorization flaw.