Service Delivery Platform EUVD-2026-46838

Organizations running Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler) versions 12.2.1.4.0 or 14.1.2.0.0 face an unpatched critical vulnerability that could allow attackers to seize complete control of these systems without any credentials or user actions. With no vendor fix available and the attack requiring only network access to exposed ports, any organization running these versions has a critical business continuity and data security exposure. Leadership should prioritize immediate network containment and monitor for patches, as the exploit path is straightforward and attractive to threat actors once details become more widely known.

Within 24 hours, identify all systems running Oracle Service Delivery Platform versions 12.2.1.4.0 or 14.1.2.0.0 and determine which have T3/IIOP protocols exposed to untrusted networks. Within 7 days, implement immediate network-based compensating controls by restricting access to T3 and IIOP ports (default ports 7001-7002 and 3700-3704) to only trusted administrative systems using firewall rules and network segmentation. Over the next 30 days, establish daily monitoring of Oracle security advisories for patch availability, complete an upgrade readiness assessment for affected systems, and develop a deployment plan to apply patches within 24 hours of release.

No vendor-released patch identified at time of analysis. Interim mitigations include: restrict network access to T3 and IIOP ports through firewall rules and network segmentation, limiting exposure to trusted systems only; disable the Messaging Enabler component if not operationally required; implement comprehensive audit logging and monitoring of these protocols; enforce principle of least privilege for administrative access; and maintain a staged upgrade plan to apply patches immediately upon availability.