Service Delivery Platform CVE-2026-60865

Exploitation requires: (1) network-level access to the Oracle Service Delivery Platform host over HTTP; (2) valid high-privileged credentials to the Service Delivery Platform (PR:H per CVSS vector - unauthenticated exploitation is not indicated by the available data); (3) the target deployment must be running version 14.1.2.0.0 or 12.2.1.4.0. The attack complexity is low (AC:L) and no user interaction is needed. Exploitation is limited to authenticated high-privileged accounts, substantially reducing the realistic attacker population to insiders, compromised admin accounts, or attackers who have previously escalated privileges. The 'Authentication Bypass' tag may indicate the bypass operates after initial authenticated access - the precise mechanism is not confirmed beyond the description and tags. Scope change impact on additional products is conditional on co-deployment of other Fusion Middleware components in the same environment.

The CVSS 3.1 base score of 6.8 reflects a medium-high severity scenario: network-accessible (AV:N), low complexity (AC:L), requiring high privileges (PR:H), no user interaction (UI:N), scope change (S:C), and confidentiality-only impact (C:H, I:N, A:N). The PR:H prerequisite substantially constrains realistic attacker population - only those with existing high-privileged access to the platform can exploit this, reducing opportunistic risk. However, the scope change increases blast radius for environments running multiple integrated Fusion Middleware products. There is a notable tension between the 'Authentication Bypass' tag and the PR:H vector: if exploitation truly requires high privileges, the 'bypass' may refer to an intra-session authorization escalation rather than a credential bypass - this distinction should be verified with Oracle's advisory. No EPSS score, KEV listing, or public exploit code was identified in the source data, suggesting no observed mass exploitation at time of analysis. For organizations running Oracle Fusion Middleware in telecom or enterprise integration roles, the scope change risk elevates this above a standalone medium-severity finding.

An attacker who has obtained or possesses high-privileged credentials to Oracle Service Delivery Platform sends a crafted HTTP request to the Messaging Enabler component, exploiting an authentication or authorization bypass within the component. This allows the attacker to read critical data - potentially including all data accessible to the Service Delivery Platform - and the scope change may allow lateral data access across other co-hosted Fusion Middleware components. No public exploit code has been identified, making targeted exploitation by a credentialed insider or compromised administrator the most plausible scenario.