What is the CVSS score of EUVD-2026-46789?

EUVD-2026-46789 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Service Delivery Platform are affected by EUVD-2026-46789?

Oracle Communications Service Delivery Platform (Messaging Enabler) versions 12.2.1.4.0 and 14.1.2.0.0 contain a privilege escalation vulnerability enabling local users to read, modify, or delete all…

How to fix or mitigate EUVD-2026-46789?

Within 24 hours: inventory all systems running Oracle Communications SDP versions 12.2.1.4.0 or 14.1.2.0.0 and assess the sensitivity of hosted data. Within 7 days: restrict local system access to essential personnel only, disable inactive local user accounts, and enable comprehensive audit logging of data operations on affected systems. Within 30 days: monitor Oracle security advisories for patch release, prepare upgrade timelines, and implement network isolation of SDP systems to restrict lateral movement if local access is compromised.

Service Delivery Platform EUVD-2026-46789

| CVE-2026-60383 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-83vr-3g53-jqrh

Authentication Bypass Oracle Service Delivery Platform

8.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.4 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

vuln.today AI

8.4 HIGH

Requires an existing low-privilege local logon so AV:L/PR:L with AC:L; scope change to adjacent products (S:C) with high confidentiality and integrity loss and no availability impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:20 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 8.4

DescriptionCVE.org

Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Service Delivery Platform executes to compromise Service Delivery Platform. While the vulnerability is in Service Delivery Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Service Delivery Platform accessible data as well as unauthorized access to critical data or complete access to all Service Delivery Platform accessible data. CVSS 3.1 Base Score 8.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).

AnalysisAI

Privilege-scoped data compromise in Oracle Communications Service Delivery Platform (Messaging Enabler component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged local user with logon access to the host read, create, modify, or delete all SDP-accessible data. Because the flaw carries a scope change (S:C), successful attacks can significantly impact adjacent Oracle products beyond SDP itself. There is no public exploit identified at time of analysis, and no EPSS or KEV signal is available in the provided data; Oracle disclosed it in the July 2026 Critical Patch Update.

Technical ContextAI

Service Delivery Platform is an Oracle Communications middleware layer (packaged under the Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0 trains) that brokers and exposes messaging and telecom service-delivery capabilities to applications. The affected component is the Messaging Enabler, which handles message routing and enablement for the platform. Oracle's own tag characterizes this as an Authentication Bypass, implying the Messaging Enabler fails to properly enforce authorization boundaries for an already-authenticated low-privilege principal, allowing that principal to reach data and functions it should not. No CWE was assigned in the source data, but the behavior is consistent with an improper access-control / authorization weakness rather than a memory-safety bug, given the confidentiality/integrity impact with no availability effect.

RemediationAI

Apply the fixes from the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the vendor advisory addressing this CVE for the 12.2.1.4.0 and 14.1.2.0.0 trains - the exact patched build number was not included in the source data, so consult the CPU patch matrix for the precise level for your version. Until patching, treat local host access as the primary control: restrict and audit interactive and service logon rights on the servers running SDP, since exploitation requires a low-privilege local account (this may affect legitimate operators and automation sharing those hosts). Tightly scope Messaging Enabler service accounts and apply least privilege to any application identities that can log on to the SDP infrastructure, and monitor SDP-accessible data stores for unexpected creation, modification, or deletion; note these compensating controls reduce but do not remove exposure given the scope-change impact to adjacent products.