What is the CVSS score of EUVD-2026-46787?

EUVD-2026-46787 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

How to fix or mitigate EUVD-2026-46787?

Within 24 hours, conduct inventory of all Oracle Service Delivery Platform instances to identify those running versions 12.2.1.4.0 or 14.1.2.0.0 and map network accessibility from untrusted sources. Within 7 days, implement network segmentation restricting WebLogic T3/IIOP protocol access to authorized systems only, enable enhanced authentication monitoring and alerting, and review access logs for unauthorized connection attempts. Within 30 days, monitor Oracle's patch release announcements for deployment to affected instances; prepare expedited patching procedures and consider temporarily isolating or migrating critical messaging workloads if patch availability extends beyond the initial remediation window.

Service Delivery Platform EUVD-2026-46787

| CVE-2026-60381 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-73cv-jm8v-4j4p

Authentication Bypass Oracle Service Delivery Platform

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network T3/IIOP vector with low complexity and low-privilege auth (PR:L, not PR:N); scope change (S:C) to additional products with full takeover justifies C/I/A all High.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:19 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 9.9

DescriptionCVE.org

Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Service Delivery Platform. While the vulnerability is in Service Delivery Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Service Delivery Platform. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Full system takeover in Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged, network-authenticated attacker to compromise the platform via the WebLogic T3/IIOP protocols. The flaw carries a CVSS 3.1 score of 9.9 with a scope change, meaning successful exploitation impacts additional downstream products beyond the vulnerable component. Addressed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle Service Delivery Platform (SDP) is a telecom/communications middleware layer built on Oracle Fusion Middleware and WebLogic Server, used to expose and orchestrate messaging and network services; the affected 'Messaging Enabler' component handles message delivery integration. The exposed attack surface is WebLogic's T3 and IIOP remote protocols - proprietary RMI-style binary protocols used for remote EJB/JNDI invocation and inter-server communication, which have historically been a rich source of deserialization and remote-invocation vulnerabilities in the Oracle/WebLogic ecosystem. No CWE was assigned in the source data, so the precise root-cause class cannot be confirmed, but the combination of T3/IIOP as the vector plus a scope change is consistent with an unsafe remote-object/deserialization or authorization flaw that lets an authenticated principal escalate control of the server process and pivot to other integrated products.

RemediationAI

Apply the fixes in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) for Service Delivery Platform 12.2.1.4.0 and 14.1.2.0.0 - Patch available per vendor advisory, but no discrete fixed version string is published separately from the CPU bundle, so map your installed version to the corresponding CPU patch. Because the vector is WebLogic T3/IIOP, the most effective compensating control until patching is to restrict these protocols: use the WebLogic 'Connection Filter' (weblogic.security.net.ConnectionFilterImpl) to allow T3/T3S/IIOP only from known internal management hosts and deny it from general/untrusted networks, and firewall the WebLogic listen ports (default 7001/7002) so T3/IIOP is not internet-reachable - the trade-off is that legitimate remote EJB/JMS clients and inter-domain traffic using T3/IIOP must be explicitly allowlisted or they will break. Also tighten account privileges on the platform since exploitation requires only low privileges (PR:L), reducing the pool of accounts that could stage an attack. Do not rely on the workaround as a permanent fix - the CPU patch is the authoritative remediation.