Oracle Service Delivery Platform EUVD-2026-61451

Exploitation requires network reachability to the Service Delivery Platform over the Oracle Net transport and, per the CVSS vector (PR:L), possession of a valid low-privileged account on the platform - no user interaction and no high privileges are needed, and the Messaging Enabler component must be the deployed/enabled subcomponent (affected releases 14.1.2.0.0 and 12.2.1.4.0). The scope change (S:C) means a successful attack can extend beyond SDP to additional connected products. Limiting factors: the attacker must already hold at least low-privilege credentials (the vendor 'Authentication Bypass' tag conflicts with this and should be verified with Oracle), the Oracle Net listener must be reachable from the attacker's position, and only the two named supported versions are confirmed affected.

The signals point to a genuine high priority within affected estates: CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N gives network reachability, low attack complexity, no user interaction, only low privileges required, and a scope change amplifying blast radius to other products - Oracle itself labels it 'easily exploitable.' Countervailing factors temper urgency: it is NOT in CISA KEV, no POC or public exploit was identified, and no EPSS score was supplied, so there is no evidence of active or imminent widespread exploitation. There is also a data conflict worth flagging: the vendor tag reads 'Authentication Bypass' (implying no auth) while the CVSS vector specifies PR:L (implying the attacker already holds low-privileged credentials) - verify with Oracle whether a valid low-privilege account is truly required, as this materially changes exposure. Real-world risk is bounded mainly by the product's limited deployment footprint rather than by exploit difficulty.

An attacker who obtains or is issued a low-privileged account reaches the Service Delivery Platform over Oracle Net and abuses the Messaging Enabler flaw to read, modify, or delete data across the entire platform without any user interaction or elevated role. Because the vulnerability carries a scope change, the same foothold can be leveraged to affect additional connected Oracle products. No public POC exists at time of analysis, so exploitation would currently require the attacker to independently develop the technique.