What is the CVSS score of EUVD-2026-46788?

EUVD-2026-46788 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of Service Delivery Platform are affected by EUVD-2026-46788?

Oracle Fusion Middleware Messaging Enabler (versions 12.2.1.4.0 and 14.1.2.0.0) is vulnerable to remote denial-of-service attacks from unauthenticated users, resulting in complete message delivery…

How to fix or mitigate EUVD-2026-46788?

Within 24 hours, identify all systems running Oracle Fusion Middleware versions 12.2.1.4.0 or 14.1.2.0.0 and immediately implement firewall rules to restrict HTTP access to the Messaging Enabler to trusted internal networks only, and enable rate limiting on service endpoints. Within 7 days, deploy Web Application Firewall (WAF) rules to detect and block malformed HTTP requests targeting the Messaging Enabler component, configure monitoring and alerting for service crashes or unexpected restarts, and validate that network changes mitigate the vulnerability through controlled testing. Within 30 days, contact Oracle to obtain upgrade timelines to versions beyond 14.1.2.0.0 that resolve this vulnerability, plan and execute the upgrade in your change management process, and document all interim controls for audit purposes.

Service Delivery Platform EUVD-2026-46788

| CVE-2026-60382 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-07-21 secalert_us@oracle.com

GHSA-3h5p-8x48-p6jm

Denial Of Service Oracle Service Delivery Platform

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Unauthenticated low-complexity HTTP reach (AV:N/AC:L/PR:N/UI:N) yields a complete DOS with no data exposure, so C:N/I:N and A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:20 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Service Delivery Platform. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Service Delivery Platform. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

AnalysisAI

Denial-of-service in Oracle Fusion Middleware Service Delivery Platform (Messaging Enabler component), versions 12.2.1.4.0 and 14.1.2.0.0, lets an unauthenticated remote attacker send crafted HTTP traffic that hangs or repeatedly crashes the service, producing a complete availability outage. Oracle rates it CVSS 3.1 7.5 with availability-only impact and flags it as easily exploitable. There is no public exploit identified at time of analysis and it is not on CISA KEV; no EPSS score was provided in the source data.

Technical ContextAI

Service Delivery Platform (SDP) is an Oracle Fusion Middleware telecom-oriented platform that exposes messaging and communication services; the affected component is the Messaging Enabler, which handles inbound messaging/signaling over HTTP. Because the flaw is reachable pre-authentication over the network and results in a hang or repeatable crash rather than data disclosure or code execution, the root cause is most consistent with an uncontrolled resource consumption or unhandled-input parsing defect in the HTTP-facing messaging path (CWE-400/CWE-248 class). The CWE was reported as N/A by Oracle and NVD, so the precise weakness class is inferred from the availability-only CVSS profile, not confirmed. No CPE strings were supplied; affected products are identified only by Oracle version strings 12.2.1.4.0 and 14.1.2.0.0.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update; patch is available per vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html, though the source data does not specify a discrete fixed build number, so confirm the exact patch level for your 12.2.1.4.0 or 14.1.2.0.0 deployment directly from that CPU. Because Oracle bundles SDP fixes into the quarterly CPU, prioritize scheduling that patch cycle. As compensating controls until patched, restrict network reachability of the Messaging Enabler HTTP interface to trusted carrier/management networks via firewall or ACL, place the endpoint behind a reverse proxy or WAF that can rate-limit and drop malformed messaging requests, and enable automatic service restart/health-check supervision so a triggered hang or crash self-recovers - noting that restart supervision only shortens outage duration and does not stop a determined attacker from repeatedly re-triggering the crash, and that tightening network exposure may disrupt legitimate messaging peers if their source ranges are not correctly allowlisted.