Service Delivery Platform CVE-2026-60501

Exploitation requires an existing authenticated account with local logon access (operating system or infrastructure level) to the host where Service Delivery Platform executes - this is the hard prerequisite established by AV:L and PR:L in the CVSS vector. The vulnerability is confined to the Messaging Enabler component of SDP; only interactions with that specific component trigger the authorization bypass. Remote or unauthenticated exploitation is not possible based on the provided CVSS vector. The scope change amplifies impact in environments where multiple Oracle Fusion Middleware products share infrastructure, meaning the blast radius is larger in consolidated deployments. Key limiting factors: mandatory local system logon eliminates all external/internet attackers; low-privilege credentials must already be held or obtained (no anonymous exploitation path); the 'easily exploitable' descriptor confirms no complex chaining is needed once the access precondition is satisfied, but that precondition itself is non-trivial in hardened environments.

The CVSS 3.1 base score of 5.2 (Medium) accurately reflects the constrained attack surface: AV:L eliminates all remote and internet-based attackers, and PR:L requires at least low-level credentials on the SDP host, further narrowing the attacker pool to insiders or compromised service accounts. The scope change (S:C) is the most consequential signal in the vector, indicating that successful exploitation can affect adjacent Oracle Fusion Middleware products - an important consideration in shared Oracle environments where multiple products run on common infrastructure. EPSS probability data is absent from the available intelligence, preventing quantitative likelihood assessment. There is no CISA KEV listing and no public POC, placing exploitation status firmly as no public exploit identified at time of analysis. The 'easily exploitable' descriptor in the official description indicates low attack complexity once access prerequisites are met, which is consistent with AC:L. Under SSVC framing: exploitation status is none/public-none, automatable is no (requires local logon), technical impact is partial - suggesting a Scheduled patch cadence is appropriate rather than emergency response. The primary realistic threat is a malicious or compromised low-privilege local account, not an external attacker.

An attacker holding a low-privileged service account or compromised developer account with local logon access to the Oracle Fusion Middleware host executes crafted operations against the Messaging Enabler component, bypassing its authorization controls. The attacker reads restricted SDP records and inserts or modifies data outside their permitted access scope, with the scope change potentially enabling equivalent unauthorized access to other Fusion Middleware products running on the same infrastructure. No public POC exists at time of analysis, so the precise exploitation mechanism requires internal knowledge of the Messaging Enabler API or reverse engineering of the component.