Service Delivery Platform EUVD-2026-79328

Exploitation requires only network reachability to the Service Delivery Platform's Messaging Enabler HTTP interface; per CVSS AV:N/AC:L/PR:N/UI:N there are no special conditions - remote unauthenticated exploitation works against default configurations of affected Oracle SDP 12.2.1.4.0 and 14.1.2.0.0. The primary limiting factor is exposure: SDP is niche telecom middleware typically deployed inside carrier/operator networks rather than on the public internet, so realistic risk depends on whether the Messaging Enabler HTTP endpoint is reachable by the attacker. No authentication, no privileges, and no user interaction limit the attack once the endpoint is reachable.

This is a genuine high-priority vulnerability, and the strongest of the September 2026 Oracle SDP cluster. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) is well-calibrated: unauthenticated (PR:N), network-reachable over HTTP, low complexity, no user interaction, and full CIA impact yielding 'takeover' - CWE-287 (improper authentication) is consistent with the pre-auth claim. Unlike its near-twins (CVE-2026-82997/82998/82999), which required a low-privileged account (PR:L) and asserted a scope change (S:C) for a 9.9, this variant needs no credentials at all and honestly reports S:U, making it the most realistically exploitable of the set. Counterbalancing signals: no EPSS score, no CISA KEV listing, and no public POC are available, so there is no evidence of active or imminent exploitation - exploitation status is 'no public exploit identified at time of analysis.' Oracle provides zero technical detail (the CPU advisory is a batch table), so the exact vulnerable endpoint and mechanism cannot be verified. Net: treat as priority patching due to pre-auth full-takeover potential, but note the absence of exploitation evidence means this is currently a prioritize-and-patch item rather than an emergency-firefight-in-the-wild scenario.

An attacker who can reach the Service Delivery Platform Messaging Enabler HTTP interface sends a crafted unauthenticated request that abuses the improper authentication flaw (CWE-287) to bypass access controls and gain administrative control of the platform. Because no credentials or user interaction are required, this can be automated against any internet- or intranet-exposed instance. No public exploit code has been identified at the time of analysis.