Service Delivery Platform CVE-2026-60866

Exploitation requires network connectivity to the HTTP service exposed by the Messaging Enabler component of Oracle Service Delivery Platform 14.1.2.0.0. No special configuration, feature flag, or non-default deployment mode is required - the CVSS vector AV:N/AC:L/PR:N/UI:N confirms this is a default-accessible, no-authentication-required attack path. Exploitation is constrained to installations running exactly version 14.1.2.0.0; no other versions are listed as affected. The primary limiting factor for most organizations is network perimeter controls: if the Messaging Enabler's HTTP port is not reachable from untrusted networks (e.g., behind a firewall or VPN), external attackers are blocked. Internal threat actors or attackers who have already gained network access bypass this control entirely. There is no requirement for elevated privileges, prior authentication, or victim user interaction of any kind.

The CVSS 3.1 base score of 6.5 reflects a medium-severity flaw: network-exploitable (AV:N), trivially triggered (AC:L), requiring no authentication (PR:N) or user interaction (UI:N), with partial confidentiality and integrity impact but no availability consequence (C:L/I:L/A:N). EPSS data was not provided, limiting probabilistic exploitation forecasting. There is no CISA KEV listing and no public proof-of-concept identified at time of analysis, which meaningfully reduces immediate urgency relative to the CVSS score in isolation. That said, the authentication bypass nature of this flaw means that even a mid-sized municipal IT team in sopot running an internet-exposed SDP instance should treat this as a priority patch cycle item rather than routine deferred maintenance. SSVC analysis signals Scheduled priority for most deployments - exploitation is not confirmed, but the attack is automatable (AC:L/PR:N) and could be scripted for bulk scanning. Organizations with SDP exposed beyond a trusted network perimeter should escalate remediation timeline accordingly.

An unauthenticated attacker with network access to the target environment sends crafted HTTP requests to the Messaging Enabler endpoint of Oracle Service Delivery Platform 14.1.2.0.0, bypassing authentication controls without any credentials or user interaction. The attacker reads a subset of platform data and issues unauthorized data modification commands - inserts, updates, or deletes - against accessible SDP data stores. No public proof-of-concept has been identified, but the AC:L rating indicates exploitation requires only knowledge of the endpoint structure and would be straightforward for any motivated attacker who locates the service.