EUVD-2026-61450
GHSA-jcc9-63ch-pvqx
Severity by source
AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H
Network TCP vector with no auth or interaction needed (PR:N/UI:N); AC:H reflects complex triggering conditions; S:C captures Messaging Enabler's cross-component impact; C:N per vendor description.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). Supported versions that are affected are 14.1.2.0.0 and 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise Service Delivery Platform. While the vulnerability is in Service Delivery Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Service Delivery Platform accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Service Delivery Platform. CVSS 3.1 Base Score 8.7 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H).
AnalysisAI
Oracle Service Delivery Platform's Messaging Enabler component (versions 14.1.2.0.0 and 12.2.1.4.0 within Oracle Fusion Middleware) can be compromised by unauthenticated remote attackers via TCP, enabling unauthorized creation, deletion, or modification of critical data and repeated complete denial of service. The CVSS S:C scope change signals that a successful attack can cascade to additional Fusion Middleware products sharing the same deployment, amplifying organizational impact beyond the directly targeted platform. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires unauthenticated TCP network access to the Oracle Service Delivery Platform's Messaging Enabler component - no credentials or user interaction (UI:N, PR:N) are needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.7 base score is driven by high integrity and availability impact combined with a scope change that extends harm beyond the directly vulnerable component, while confidentiality is unaffected. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply Oracle's August 2026 Critical Patch Update, available at https://www.oracle.com/security-alerts/cspuaug2026.html, which addresses this vulnerability in Service Delivery Platform versions 14.1.2.0.0 and 12.2.1.4.0. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running Oracle Service Delivery Platform Messaging Enabler versions 14.1.2.0.0 and 12.2.1.4.0 in your environment. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Service Delivery Platform
View allComplete remote takeover of Oracle Service Delivery Platform (a component of Oracle Fusion Middleware, versions 12.2.1.4
Complete takeover of Oracle Service Delivery Platform is achievable by an unauthenticated remote attacker via SOAP reque
Privilege-abusing remote compromise in Oracle Communications Service Delivery Platform (Messaging Enabler component), ve
Full system takeover in Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) versions 12.2.
Complete takeover of Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) is possible by an
Complete takeover of Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) is achievable by
Complete takeover of Oracle Service Delivery Platform (part of Oracle Fusion Middleware) is possible via its Messaging E
Complete takeover of Oracle Communications Service Delivery Platform (SDP) 12.2.1.4.0 and 14.1.2.0.0, shipped within Ora
Full compromise of Oracle Communications Service Delivery Platform (Messaging Enabler component) versions 12.2.1.4.0 and
Complete takeover of Oracle Communications/Fusion Middleware Service Delivery Platform (versions 12.2.1.4.0 and 14.1.2.0
Complete takeover of Oracle Communications Service Delivery Platform (Messaging Enabler component) versions 12.2.1.4.0 a
Full compromise of Oracle Communications Service Delivery Platform (Messaging Enabler component) in Oracle Fusion Middle
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today