EUVD-2026-79478
GHSA-v99p-hwj5-99f7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach SDP SOAP endpoint over network
-
DeliverySend crafted SOAP request
-
ExploitBypass authentication (CWE-287)
-
ExecutionGain full control of platform
-
ImpactRead/modify data and disrupt service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation is possible against the SOAP interface of Oracle Service Delivery Platform (Messaging Enabler) versions 12.2.1.4.0 and 14.1.2.0.0, per AV:N/AC:L/PR:N/UI:N. The only meaningful prerequisites are network reachability to the SDP SOAP endpoint and running an affected version; no authentication, user interaction, or non-default configuration is required. Limiting factor: SDP is niche telecom middleware, so realistic exposure depends on whether the SOAP-based Messaging Enabler is deployed and network-reachable rather than on any special feature toggle. |
| Impact | This is a genuinely high-priority vulnerability by base-severity signals: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) describes a remote, unauthenticated, low-complexity SOAP attack yielding full compromise (complete confidentiality, integrity and availability impact), consistent with CWE-287 (authentication bypass) and the vendor's own 'takeover' wording. However, real-world exploitation signals are absent or unavailable: no EPSS score was provided, the vulnerability is NOT in CISA KEV (no active exploitation confirmed), and no public POC is identified. There is no SSVC decision data supplied. The net picture is a legitimately critical CVSS with no evidence of exploitation in the wild - priority is driven by the pre-auth full-takeover profile, not by observed activity. Note that Oracle's Sep 2026 CPU (cspusep2026) publishes no technical detail, so the exact attack mechanics cannot be independently verified, and the CVSS is self-reported by Oracle. Prevalence is low (niche telecom middleware), which tempers aggregate exposure even though any single exposed instance is high-risk. |
| Exploit ScenarioDerived | An attacker with network reachability to the Service Delivery Platform's SOAP endpoint sends a crafted SOAP request that bypasses authentication (CWE-287), requiring no credentials and no user interaction. Because attack complexity is low and privileges are none, a single request path leads to full compromise ('takeover') of the SDP instance. No public exploit code is currently identified, so exploitation would require attacker-developed tooling against an undocumented Oracle CPU fix. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Unauthenticated attackers with network access to the SOAP interface of Oracle Service Delivery Platform (SDP) versions 12.2.1.4.0 and 14.1.2.0.0 can bypass authentication and achieve full takeover of the product, per CWE-287 and a CVSS 3.1 base score of 9.8. The flaw is remotely exploitable without privileges or user interaction (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis. Real-world risk is concentrated in telecom environments where the Messaging Enabler component is deployed and network-reachable.
RemediationAI
Apply the patch from Oracle when released; the available data does not specify an exact fix version, so monitor the Oracle security advisory at https://www.oracle.com/security-alerts/cspusep2026.html for patch availability and version details. In the interim, restrict network access to the SDP SOAP endpoint using firewall rules or network ACLs so that only trusted hosts can reach it; this may break legitimate integrations, so carefully inventory required sources. If the Messaging Enabler component is not business-critical, consider disabling it or the SOAP listener, accepting loss of messaging functionality. Deploy a reverse proxy or API gateway that enforces authentication and input validation in front of SDP, though this adds complexity and potential latency. Monitor SDP and SOAP logs for anomalous unauthenticated requests, and segment SDP from untrusted networks. These compensating controls reduce exposure but do not eliminate the underlying authentication bypass; patching is the definitive fix once available.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Fusion Middleware Service Delivery Platform (SDP) is a telecom-oriented middleware platform, and its Messaging Enabler component exposes SOAP-based web services for service delivery and messaging functions. The vulnerability is classified as CWE-287 (Improper Authentication), meaning the SOAP interface fails to properly authenticate requests before allowing access to privileged operations, enabling an unauthenticated remote attacker to bypass authentication entirely. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects a low-complexity network attack requiring no credentials, no user interaction, and resulting in high confidentiality, integrity, and availability impact within the unchanged scope of the SDP product. The tags 'Authentication Bypass' and 'Oracle' further reinforce the root-cause class, and the EUVD entry EUVD-2026-79478 independently lists the same affected versions.
Know when Java gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vendor describes easily exploitable unauthenticated network SOAP attack yielding full takeover, so AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H; no evidence of scope change (S:U).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SOAP to compromise Service Delivery Platform. Successful attacks of this vulnerability can result in takeover of Service Delivery Platform. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Service Delivery Platform (SDP) versions 12.2.1.4.0 and 14.1.2.0.0 face a critical unauthenticated flaw that can allow a remote attacker to take full control of the product. Telecommunications organizations with the Messaging Enabler component reachable from the network are most exposed, creating risk of service disruption and sensitive data compromise. Leadership should prioritize immediate containment: No vendor-released patch identified at time of analysis, and no public exploit identified at time of analysis.
No vendor-released patch identified at time of analysis; restrict SOAP interface access to trusted networks, disable unnecessary SOAP endpoints, segment Messaging Enabler deployments, deploy WAF/IPS virtual patching, and monitor authentication logs.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Exploit-DB