EUVD-2026-61451
GHSA-3pr6-766h-5pwg
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Reachable over Oracle Net (AV:N/AC:L) by a credentialed low-privilege user (PR:L), no interaction, scope change to adjacent products (S:C), full read/write of data (C:H/I:H) but no availability impact (A:N).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). Supported versions that are affected are 14.1.2.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via Oracle Net to compromise Service Delivery Platform. While the vulnerability is in Service Delivery Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Service Delivery Platform accessible data as well as unauthorized access to critical data or complete access to all Service Delivery Platform accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).
AnalysisAI
Privilege-abusing data compromise in Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) versions 14.1.2.0.0 and 12.2.1.4.0 lets a low-privileged attacker with Oracle Net network access read, alter, create, or delete all platform-accessible data, with a scope change that can significantly impact additional connected products. Rated CVSS 3.1 9.6 (Critical) with high confidentiality and integrity impact but no availability impact, this is remotely reachable and low-complexity. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the Service Delivery Platform over the Oracle Net transport and, per the CVSS vector (PR:L), possession of a valid low-privileged account on the platform - no user interaction and no high privileges are needed, and the Messaging Enabler component must be the deployed/enabled subcomponent (affected releases 14.1.2.0.0 and 12.2.1.4.0). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals point to a genuine high priority within affected estates: CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N gives network reachability, low attack complexity, no user interaction, only low privileges required, and a scope change amplifying blast radius to other products - Oracle itself labels it 'easily exploitable.' Countervailing factors temper urgency: it is NOT in CISA KEV, no POC or public exploit was identified, and no EPSS score was supplied, so there is no evidence of active or imminent widespread exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fixes delivered in Oracle's August 2026 Critical Patch Update (patch available per vendor advisory at https://www.oracle.com/security-alerts/cspuaug2026.html) to both affected releases (14.1.2.0.0 and 12.2.1.4.0); Oracle does not publish separate point-release version numbers in the CPU, so schedule the CPU patch rather than a discrete tagged build. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Oracle Service Delivery Platform deployments and confirm whether versions 14.1.2.0.0 or 12.2.1.4.0 are operational; assess network exposure and document dependent systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Service Delivery Platform
View allComplete remote takeover of Oracle Service Delivery Platform (a component of Oracle Fusion Middleware, versions 12.2.1.4
Complete takeover of Oracle Service Delivery Platform is achievable by an unauthenticated remote attacker via SOAP reque
Privilege-abusing remote compromise in Oracle Communications Service Delivery Platform (Messaging Enabler component), ve
Full system takeover in Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) versions 12.2.
Complete takeover of Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) is possible by an
Complete takeover of Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) is achievable by
Complete takeover of Oracle Service Delivery Platform (part of Oracle Fusion Middleware) is possible via its Messaging E
Complete takeover of Oracle Communications Service Delivery Platform (SDP) 12.2.1.4.0 and 14.1.2.0.0, shipped within Ora
Full compromise of Oracle Communications Service Delivery Platform (Messaging Enabler component) versions 12.2.1.4.0 and
Complete takeover of Oracle Communications/Fusion Middleware Service Delivery Platform (versions 12.2.1.4.0 and 14.1.2.0
Complete takeover of Oracle Communications Service Delivery Platform (Messaging Enabler component) versions 12.2.1.4.0 a
Full compromise of Oracle Communications Service Delivery Platform (Messaging Enabler component) in Oracle Fusion Middle
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today