EUVD-2026-46790
GHSA-gh46-h4gw-7ffj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach WebLogic T3/IIOP listener
-
DeliverySend crafted serialized request
-
ExploitExploit Messaging Enabler flaw
-
ExecutionExecute as SDP service
-
ImpactFull platform takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the WebLogic T3 or IIOP protocol listeners exposed by the affected Service Delivery Platform 12.2.1.4.0 or 14.1.2.0.0 installation - these are the exact named entry points in the description. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no special configuration, and no user interaction are required against a reachable instance. The primary limiting factor is network exposure of the T3/IIOP ports: deployments that firewall these listeners to trusted management hosts, or that have disabled IIOP/T3, substantially raise the bar. Only the two named versions are affected, so version confirmation is a prerequisite for realistic targeting. |
| Impact | All available signals point to top-tier risk: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H means network-reachable, low-complexity, no privileges and no user interaction, yielding full compromise - the classic 9.8 profile. No EPSS score was provided in the input, and there is no POC or KEV signal, so scoring reflects potential rather than observed exploitation. One conflict must be flagged: the Oracle-supplied tag reads 'Information Disclosure,' yet the description and CVSS (I:H/A:H) describe full takeover including integrity and availability loss - the vector should be treated as authoritative over the tag, but verify the precise impact class with Oracle. T3/IIOP vulnerabilities in WebLogic have historically been rapidly weaponized once patches are reverse-engineered, so despite the current absence of a public exploit, this should be prioritized for immediate patching rather than deferred. |
| Exploit ScenarioDerived | An attacker with network reachability to the SDP server's WebLogic T3 or IIOP listener sends a crafted serialized request to the Messaging Enabler component without any credentials or user interaction. Successful processing yields full takeover of the Service Delivery Platform, giving the attacker control over the telecom service-orchestration middleware. No public exploit is currently identified, but the low attack complexity and network vector make reliable exploitation feasible once details are reverse-engineered from the patch. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Complete takeover of Oracle Communications Service Delivery Platform (SDP) 12.2.1.4.0 and 14.1.2.0.0, shipped within Oracle Fusion Middleware, is achievable by a remote unauthenticated attacker reaching the T3 or IIOP protocols exposed by the underlying WebLogic Server (Messaging Enabler component). Rated CVSS 3.1 9.8 with full confidentiality, integrity and availability impact, this was disclosed in the Oracle July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
RemediationAI
Apply the fixes shipped in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) for the affected Service Delivery Platform 12.2.1.4.0 and 14.1.2.0.0 releases; Oracle's CPU model bundles the exact patch numbers per product line, so consult the advisory for the specific patch ID matching your installation, as no standalone fixed version string is given in this input. Because the attack surface is the WebLogic T3 and IIOP listeners, the strongest compensating control until patching is to disable T3/IIOP where not required or restrict them with a WebLogic connection filter (weblogic.security.net.ConnectionFilterImpl) allowing only trusted management hosts - trade-off: this can break inter-cluster RMI, JMS, and admin tooling that rely on T3/IIOP, so test in staging. Additionally, block external access to the WebLogic listen ports (default 7001/7002 and any IIOP ports) at the network firewall and place the SDP admin/management interfaces behind a segmented management network. These controls reduce reachability but do not remove the underlying flaw, so treat them as interim only.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Service Delivery Platform is Oracle's carrier-grade telecom middleware for exposing and orchestrating network services, deployed on top of Oracle WebLogic Server as part of Fusion Middleware. The exposed T3 (WebLogic's proprietary RMI transport) and IIOP (CORBA) protocols are the same remote entry points historically abused in WebLogic deserialization RCE chains, where crafted serialized Java objects sent to the listen port are deserialized without adequate validation. Oracle did not assign a CWE (listed N/A), but the T3/IIOP + full-takeover pattern is consistent with unsafe deserialization of untrusted data (CWE-502) or a related remote object/authentication weakness in the Messaging Enabler component. Note the Oracle tag labels this 'Information Disclosure,' which conflicts with the description's 'takeover' language - see risk assessment.
Know when Service Delivery Platform gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated network attack over T3/IIOP with no user interaction and low complexity yields full takeover, so AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Service Delivery Platform. Successful attacks of this vulnerability can result in takeover of Service Delivery Platform. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Communications Service Delivery Platform (SDP) versions 12.2.1.4.0 and 14.1.2.0.0, commonly deployed within Oracle Fusion Middleware, contain a critical remote vulnerability that permits unauthenticated attackers to fully compromise affected systems. This exposes organizations to complete data breach, operational disruption, and infrastructure takeover with no remediation currently available. Immediate action is required to contain this risk.
No vendor-released patch identified at time of analysis. Interim mitigations include: disable or restrict network access to T3 and IIOP protocols on WebLogic Messaging Enabler if not operationally required; implement network segmentation to limit lateral movement and attacker reach following exploitation; enable comprehensive audit logging on affected systems; consider disabling the Messaging Enabler component if unused in your SDP configuration.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Service Delivery Platform
View allComplete remote takeover of Oracle Service Delivery Platform (a component of Oracle Fusion Middleware, versions 12.2.1.4
Complete takeover of Oracle Service Delivery Platform is achievable by an unauthenticated remote attacker via SOAP reque
Privilege-abusing remote compromise in Oracle Communications Service Delivery Platform (Messaging Enabler component), ve
Full system takeover in Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) versions 12.2.
Complete takeover of Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) is possible by an
Complete takeover of Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) is achievable by
Complete takeover of Oracle Service Delivery Platform (part of Oracle Fusion Middleware) is possible via its Messaging E
Full compromise of Oracle Communications Service Delivery Platform (Messaging Enabler component) versions 12.2.1.4.0 and
Complete takeover of Oracle Communications/Fusion Middleware Service Delivery Platform (versions 12.2.1.4.0 and 14.1.2.0
Complete takeover of Oracle Communications Service Delivery Platform (Messaging Enabler component) versions 12.2.1.4.0 a
Full compromise of Oracle Communications Service Delivery Platform (Messaging Enabler component) in Oracle Fusion Middle
Complete takeover of Oracle Service Delivery Platform (a Fusion Middleware component) is possible when unauthenticated a
Exploit-DB