What is the CVSS score of EUVD-2026-46794?

EUVD-2026-46794 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Service Delivery Platform are affected by EUVD-2026-46794?

Oracle Service Delivery Platform versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical vulnerability allowing complete remote takeover via unauthenticated WebLogic protocol exploitation; no public…

How to fix or mitigate EUVD-2026-46794?

Within 24 hours, identify all systems running Oracle Service Delivery Platform versions 12.2.1.4.0 and 14.1.2.0.0, and immediately restrict network access to WebLogic T3 and IIOP protocol ports (typically 7001-7002) at the firewall, allowing connections only from authenticated internal networks. Within 7 days, disable T3 and IIOP protocols entirely if not operationally required by business applications, implement network segmentation to isolate affected systems from untrusted networks, and deploy intrusion detection signatures targeting WebLogic deserialization attacks. Within 30 days, establish a timeline with Oracle support for patched versions of Fusion Middleware, conduct comprehensive testing of upgrade paths in pre-production, and deploy enhanced logging and monitoring specifically for WebLogic protocol activity across all Fusion installations.

Oracle Service Delivery Platform EUVD-2026-46794

| CVE-2026-60388 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-6xc2-chqh-rqm7

Authentication Bypass Oracle Service Delivery Platform

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated low-complexity remote access via T3/IIOP yields AV:N/AC:L/PR:N/UI:N, and vendor-stated full product takeover justifies C:H/I:H/A:H with no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:23 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Service Delivery Platform. Successful attacks of this vulnerability can result in takeover of Service Delivery Platform. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Complete takeover of Oracle Service Delivery Platform (a Fusion Middleware component) is possible when unauthenticated attackers reach the T3 or IIOP protocols exposed by the underlying WebLogic server, per Oracle's July 2026 Critical Patch Update. The Messaging Enabler component in versions 12.2.1.4.0 and 14.1.2.0.0 can be fully compromised (confidentiality, integrity, and availability), earning a CVSS 9.8. No public exploit has been identified at time of analysis, but the T3/IIOP attack surface has a long history of critical WebLogic deserialization exploitation.

Technical ContextAI

Service Delivery Platform is an Oracle Fusion Middleware telecom/communications product that runs atop Oracle WebLogic Server, and the vulnerability sits in its Messaging Enabler component. The named attack vectors - T3 and IIOP - are WebLogic's proprietary remote invocation protocols (T3 is WebLogic's native RMI transport; IIOP is the CORBA interoperability protocol), which have historically been the delivery channel for Java deserialization flaws in WebLogic. Oracle does not assign a CWE for this entry, but the pattern (unauthenticated remote takeover reachable only via T3/IIOP) is characteristic of insecure deserialization of untrusted data (CWE-502) in the WebLogic RMI stack, though the exact root cause is not confirmed in the available data.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the primary and only vendor-sanctioned remediation for both affected versions 12.2.1.4.0 and 14.1.2.0.0; Patch available per vendor advisory, though the input does not provide a discrete patched build number to cite. Because the attack requires reaching the T3 and IIOP protocols, the strongest compensating control is to restrict those protocols: use WebLogic connection filters (weblogic.security.net.ConnectionFilterImpl) to allow T3/T3S/IIOP only from trusted management hosts, and block the WebLogic listen ports (default 7001/7002) at the network firewall from all untrusted segments - the trade-off is that legitimate remote T3/IIOP clients and inter-cluster traffic must be explicitly allowlisted or they will break. Where T3/IIOP are not required by the application, disabling the IIOP protocol on the server's listen ports removes the vector entirely at the cost of CORBA interoperability. These controls reduce exposure but are not a substitute for the CPU patch.