Service Delivery Platform
Monthly
Privilege-abusing data compromise in Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) versions 14.1.2.0.0 and 12.2.1.4.0 lets a low-privileged attacker with Oracle Net network access read, alter, create, or delete all platform-accessible data, with a scope change that can significantly impact additional connected products. Rated CVSS 3.1 9.6 (Critical) with high confidentiality and integrity impact but no availability impact, this is remotely reachable and low-complexity. No public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
Oracle Service Delivery Platform's Messaging Enabler component (versions 14.1.2.0.0 and 12.2.1.4.0 within Oracle Fusion Middleware) can be compromised by unauthenticated remote attackers via TCP, enabling unauthorized creation, deletion, or modification of critical data and repeated complete denial of service. The CVSS S:C scope change signals that a successful attack can cascade to additional Fusion Middleware products sharing the same deployment, amplifying organizational impact beyond the directly targeted platform. No public exploit has been identified at time of analysis, and the high attack complexity (AC:H) requirement reduces the likelihood of opportunistic mass exploitation.
Complete takeover of Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) is possible by an unauthenticated remote attacker over the T3 or IIOP protocols, affecting versions 12.2.1.4.0 and 14.1.2.0.0. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) the attack is network-reachable, low-complexity, and requires no authentication or user interaction, yielding full confidentiality, integrity, and availability compromise (9.8 Critical). No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated pre-auth nature over exposed WebLogic protocols makes this a high-priority patch.
Full compromise of Oracle Communications Service Delivery Platform (Messaging Enabler component) in Oracle Fusion Middleware is achievable by a remote unauthenticated attacker over the T3 and IIOP protocols. Affecting versions 12.2.1.4.0 and 14.1.2.0.0, successful exploitation results in complete takeover of the platform with high confidentiality, integrity, and availability impact (CVSS 9.8). No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but the network-reachable, no-privilege attack profile makes it a high-priority patch.
Information disclosure with scope change in Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged remote attacker read all data accessible to the platform and impact additional connected products. The flaw is network-exploitable over HTTP with low attack complexity and only minimal existing privileges, and Oracle tags it as an authentication bypass affecting confidentiality only (no integrity or availability impact). No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low exploitation barrier and cross-boundary scope change make it a meaningful risk in exposed telecom/messaging deployments.
Complete remote takeover of Oracle Service Delivery Platform (a component of Oracle Fusion Middleware, versions 12.2.1.4.0 and 14.1.2.0.0) is possible via the Messaging Enabler component, reachable over HTTP by an unauthenticated attacker. The flaw carries a maximum CVSS 3.1 base score of 10.0 with a scope change, meaning successful exploitation not only fully compromises the platform's confidentiality, integrity, and availability but can also significantly impact other connected products. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability (AV:N/AC:L/PR:N/UI:N) makes it a top-priority patch from the Oracle July 2026 Critical Patch Update.
Complete takeover of Oracle Service Delivery Platform (a Fusion Middleware component) is possible when unauthenticated attackers reach the T3 or IIOP protocols exposed by the underlying WebLogic server, per Oracle's July 2026 Critical Patch Update. The Messaging Enabler component in versions 12.2.1.4.0 and 14.1.2.0.0 can be fully compromised (confidentiality, integrity, and availability), earning a CVSS 9.8. No public exploit has been identified at time of analysis, but the T3/IIOP attack surface has a long history of critical WebLogic deserialization exploitation.
Full takeover of Oracle Fusion Middleware's Service Delivery Platform (Messaging Enabler component) is possible by unauthenticated remote attackers reaching the T3 or IIOP protocols. Versions 12.2.1.4.0 and 14.1.2.0.0 are affected, and the CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) reflects complete loss of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, but the T3/IIOP attack surface is a historically abused deserialization vector on the underlying WebLogic stack, warranting priority patching.
Complete takeover of Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) is achievable by remote unauthenticated attackers over HTTP, per Oracle's July 2026 Critical Patch Update. Affecting supported versions 12.2.1.4.0 and 14.1.2.0.0, the flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability and unauthenticated network reach make it a high-priority patching item.
Complete takeover of Oracle Service Delivery Platform (part of Oracle Fusion Middleware) is possible via its Messaging Enabler component, affecting versions 12.2.1.4.0 and 14.1.2.0.0. A remote, unauthenticated attacker reaching the T3 or IIOP protocol ports can fully compromise the platform (full confidentiality, integrity, and availability loss, CVSS 9.8). This was fixed in the Oracle Critical Patch Update of July 2026; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Complete takeover of Oracle Communications Service Delivery Platform (SDP) 12.2.1.4.0 and 14.1.2.0.0, shipped within Oracle Fusion Middleware, is achievable by a remote unauthenticated attacker reaching the T3 or IIOP protocols exposed by the underlying WebLogic Server (Messaging Enabler component). Rated CVSS 3.1 9.8 with full confidentiality, integrity and availability impact, this was disclosed in the Oracle July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Privilege-scoped data compromise in Oracle Communications Service Delivery Platform (Messaging Enabler component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged local user with logon access to the host read, create, modify, or delete all SDP-accessible data. Because the flaw carries a scope change (S:C), successful attacks can significantly impact adjacent Oracle products beyond SDP itself. There is no public exploit identified at time of analysis, and no EPSS or KEV signal is available in the provided data; Oracle disclosed it in the July 2026 Critical Patch Update.
Denial-of-service in Oracle Fusion Middleware Service Delivery Platform (Messaging Enabler component), versions 12.2.1.4.0 and 14.1.2.0.0, lets an unauthenticated remote attacker send crafted HTTP traffic that hangs or repeatedly crashes the service, producing a complete availability outage. Oracle rates it CVSS 3.1 7.5 with availability-only impact and flags it as easily exploitable. There is no public exploit identified at time of analysis and it is not on CISA KEV; no EPSS score was provided in the source data.
Full system takeover in Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged, network-authenticated attacker to compromise the platform via the WebLogic T3/IIOP protocols. The flaw carries a CVSS 3.1 score of 9.9 with a scope change, meaning successful exploitation impacts additional downstream products beyond the vulnerable component. Addressed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full takeover of Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) is possible in versions 12.2.1.4.0 and 14.1.2.0.0, where an unauthenticated remote attacker can compromise the platform over HTTP. Oracle rates this a CVSS 9.8 with high confidentiality, integrity, and availability impact, and it was disclosed in the July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Complete takeover of Oracle Service Delivery Platform is achievable by an unauthenticated remote attacker via SOAP requests to the Messaging Enabler component, affecting Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0. Rated CVSS 10.0 with a scope change, successful exploitation can pivot to compromise additional connected products beyond SDP itself. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the maximum score and trivial exploitation warrant urgent patching via Oracle's July 2026 Critical Patch Update.
Full compromise of Oracle Communications Service Delivery Platform (Messaging Enabler component) versions 12.2.1.4.0 and 14.1.2.0.0 allows an unauthenticated remote attacker to take over the platform via crafted HTTP requests. Oracle rates this 9.8 (CVSS 3.1) with full confidentiality, integrity, and availability impact, disclosed in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege-abusing remote compromise in Oracle Communications Service Delivery Platform (Messaging Enabler component), versions 12.2.1.4.0 and 14.1.2.0.0, lets a low-privileged attacker reachable over the WebLogic T3/IIOP protocols read and modify all SDP-accessible data and cause partial denial of service. The CVSS 3.1 base score reaches 9.9 because of a scope change: the flaw sits in SDP but successful attacks significantly impact other products co-hosted in the WebLogic domain. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the low attack complexity over a network-facing T3/IIOP surface makes it a high-priority patch.
Complete takeover of Oracle Communications/Fusion Middleware Service Delivery Platform (versions 12.2.1.4.0 and 14.1.2.0.0, Messaging Enabler component) is possible by an unauthenticated remote attacker reaching the T3 or IIOP protocol. The flaw scores CVSS 3.1 9.8 with full confidentiality, integrity, and availability impact and requires no user interaction; no public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the T3/IIOP attack surface historically maps to WebLogic-style deserialization abuse. It was self-reported by Oracle and disclosed in the July 2026 Critical Patch Update.
Complete takeover of Oracle Communications Service Delivery Platform (Messaging Enabler component) versions 12.2.1.4.0 and 14.1.2.0.0 is possible by an unauthenticated remote attacker reaching the server over the T3 or IIOP protocols. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N, full C/I/A impact), placing it among Oracle's most severe July 2026 Critical Patch Update fixes. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the T3/IIOP attack surface has a long history of trivially weaponized deserialization exploits.
Complete takeover of Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) is achievable by an unauthenticated remote attacker who reaches the T3 or IIOP protocol endpoints. Versions 12.2.1.4.0 and 14.1.2.0.0 are affected, carrying a maximum-severity CVSS 9.8 with full confidentiality, integrity, and availability loss. No public exploit is identified at time of analysis and the CVE is not in CISA KEV, but the T3/IIOP attack surface is historically a high-value target in the Oracle WebLogic/Fusion stack.
Unauthenticated remote data compromise affects Oracle Service Delivery Platform 14.1.2.0.0 via its Messaging Enabler component, reachable over HTTP without credentials. The authentication bypass allows network attackers to read a subset of platform data and perform unauthorized insert, update, or delete operations against accessible data stores. No public exploit code or active exploitation has been identified at time of analysis, and Oracle addressed this in the August 2026 Critical Patch Update.
Unauthorized confidential data access in Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) is achievable by network-adjacent high-privileged attackers over HTTP, with a scope change that can impact additional Fusion Middleware products beyond the primary target. Affected versions are 14.1.2.0.0 and 12.2.1.4.0. Classified as 'easily exploitable' by Oracle, the flaw carries a CVSS 3.1 score of 6.8 with scope change flagged - though no public exploit code or CISA KEV listing has been identified at time of analysis.
Oracle Service Delivery Platform's Messaging Enabler component in versions 12.2.1.4.0 and 14.1.2.0.0 allows low-privileged local users to perform unauthorized read and write operations on platform data, with a documented scope change that extends impact to additional co-deployed Oracle Fusion Middleware products. The vulnerability requires only a low-privileged local account on the hosting infrastructure, making insider threats and compromised service accounts the primary risk vector. No public exploit has been identified at time of analysis; this was disclosed as part of Oracle's July 2026 Critical Patch Update.
Privilege-abusing data compromise in Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) versions 14.1.2.0.0 and 12.2.1.4.0 lets a low-privileged attacker with Oracle Net network access read, alter, create, or delete all platform-accessible data, with a scope change that can significantly impact additional connected products. Rated CVSS 3.1 9.6 (Critical) with high confidentiality and integrity impact but no availability impact, this is remotely reachable and low-complexity. No public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
Oracle Service Delivery Platform's Messaging Enabler component (versions 14.1.2.0.0 and 12.2.1.4.0 within Oracle Fusion Middleware) can be compromised by unauthenticated remote attackers via TCP, enabling unauthorized creation, deletion, or modification of critical data and repeated complete denial of service. The CVSS S:C scope change signals that a successful attack can cascade to additional Fusion Middleware products sharing the same deployment, amplifying organizational impact beyond the directly targeted platform. No public exploit has been identified at time of analysis, and the high attack complexity (AC:H) requirement reduces the likelihood of opportunistic mass exploitation.
Complete takeover of Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) is possible by an unauthenticated remote attacker over the T3 or IIOP protocols, affecting versions 12.2.1.4.0 and 14.1.2.0.0. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) the attack is network-reachable, low-complexity, and requires no authentication or user interaction, yielding full confidentiality, integrity, and availability compromise (9.8 Critical). No public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated pre-auth nature over exposed WebLogic protocols makes this a high-priority patch.
Full compromise of Oracle Communications Service Delivery Platform (Messaging Enabler component) in Oracle Fusion Middleware is achievable by a remote unauthenticated attacker over the T3 and IIOP protocols. Affecting versions 12.2.1.4.0 and 14.1.2.0.0, successful exploitation results in complete takeover of the platform with high confidentiality, integrity, and availability impact (CVSS 9.8). No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but the network-reachable, no-privilege attack profile makes it a high-priority patch.
Information disclosure with scope change in Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged remote attacker read all data accessible to the platform and impact additional connected products. The flaw is network-exploitable over HTTP with low attack complexity and only minimal existing privileges, and Oracle tags it as an authentication bypass affecting confidentiality only (no integrity or availability impact). No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low exploitation barrier and cross-boundary scope change make it a meaningful risk in exposed telecom/messaging deployments.
Complete remote takeover of Oracle Service Delivery Platform (a component of Oracle Fusion Middleware, versions 12.2.1.4.0 and 14.1.2.0.0) is possible via the Messaging Enabler component, reachable over HTTP by an unauthenticated attacker. The flaw carries a maximum CVSS 3.1 base score of 10.0 with a scope change, meaning successful exploitation not only fully compromises the platform's confidentiality, integrity, and availability but can also significantly impact other connected products. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability (AV:N/AC:L/PR:N/UI:N) makes it a top-priority patch from the Oracle July 2026 Critical Patch Update.
Complete takeover of Oracle Service Delivery Platform (a Fusion Middleware component) is possible when unauthenticated attackers reach the T3 or IIOP protocols exposed by the underlying WebLogic server, per Oracle's July 2026 Critical Patch Update. The Messaging Enabler component in versions 12.2.1.4.0 and 14.1.2.0.0 can be fully compromised (confidentiality, integrity, and availability), earning a CVSS 9.8. No public exploit has been identified at time of analysis, but the T3/IIOP attack surface has a long history of critical WebLogic deserialization exploitation.
Full takeover of Oracle Fusion Middleware's Service Delivery Platform (Messaging Enabler component) is possible by unauthenticated remote attackers reaching the T3 or IIOP protocols. Versions 12.2.1.4.0 and 14.1.2.0.0 are affected, and the CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) reflects complete loss of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, but the T3/IIOP attack surface is a historically abused deserialization vector on the underlying WebLogic stack, warranting priority patching.
Complete takeover of Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) is achievable by remote unauthenticated attackers over HTTP, per Oracle's July 2026 Critical Patch Update. Affecting supported versions 12.2.1.4.0 and 14.1.2.0.0, the flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability and unauthenticated network reach make it a high-priority patching item.
Complete takeover of Oracle Service Delivery Platform (part of Oracle Fusion Middleware) is possible via its Messaging Enabler component, affecting versions 12.2.1.4.0 and 14.1.2.0.0. A remote, unauthenticated attacker reaching the T3 or IIOP protocol ports can fully compromise the platform (full confidentiality, integrity, and availability loss, CVSS 9.8). This was fixed in the Oracle Critical Patch Update of July 2026; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Complete takeover of Oracle Communications Service Delivery Platform (SDP) 12.2.1.4.0 and 14.1.2.0.0, shipped within Oracle Fusion Middleware, is achievable by a remote unauthenticated attacker reaching the T3 or IIOP protocols exposed by the underlying WebLogic Server (Messaging Enabler component). Rated CVSS 3.1 9.8 with full confidentiality, integrity and availability impact, this was disclosed in the Oracle July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Privilege-scoped data compromise in Oracle Communications Service Delivery Platform (Messaging Enabler component) versions 12.2.1.4.0 and 14.1.2.0.0 lets a low-privileged local user with logon access to the host read, create, modify, or delete all SDP-accessible data. Because the flaw carries a scope change (S:C), successful attacks can significantly impact adjacent Oracle products beyond SDP itself. There is no public exploit identified at time of analysis, and no EPSS or KEV signal is available in the provided data; Oracle disclosed it in the July 2026 Critical Patch Update.
Denial-of-service in Oracle Fusion Middleware Service Delivery Platform (Messaging Enabler component), versions 12.2.1.4.0 and 14.1.2.0.0, lets an unauthenticated remote attacker send crafted HTTP traffic that hangs or repeatedly crashes the service, producing a complete availability outage. Oracle rates it CVSS 3.1 7.5 with availability-only impact and flags it as easily exploitable. There is no public exploit identified at time of analysis and it is not on CISA KEV; no EPSS score was provided in the source data.
Full system takeover in Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged, network-authenticated attacker to compromise the platform via the WebLogic T3/IIOP protocols. The flaw carries a CVSS 3.1 score of 9.9 with a scope change, meaning successful exploitation impacts additional downstream products beyond the vulnerable component. Addressed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full takeover of Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) is possible in versions 12.2.1.4.0 and 14.1.2.0.0, where an unauthenticated remote attacker can compromise the platform over HTTP. Oracle rates this a CVSS 9.8 with high confidentiality, integrity, and availability impact, and it was disclosed in the July 2026 Critical Patch Update. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Complete takeover of Oracle Service Delivery Platform is achievable by an unauthenticated remote attacker via SOAP requests to the Messaging Enabler component, affecting Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0. Rated CVSS 10.0 with a scope change, successful exploitation can pivot to compromise additional connected products beyond SDP itself. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the maximum score and trivial exploitation warrant urgent patching via Oracle's July 2026 Critical Patch Update.
Full compromise of Oracle Communications Service Delivery Platform (Messaging Enabler component) versions 12.2.1.4.0 and 14.1.2.0.0 allows an unauthenticated remote attacker to take over the platform via crafted HTTP requests. Oracle rates this 9.8 (CVSS 3.1) with full confidentiality, integrity, and availability impact, disclosed in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Privilege-abusing remote compromise in Oracle Communications Service Delivery Platform (Messaging Enabler component), versions 12.2.1.4.0 and 14.1.2.0.0, lets a low-privileged attacker reachable over the WebLogic T3/IIOP protocols read and modify all SDP-accessible data and cause partial denial of service. The CVSS 3.1 base score reaches 9.9 because of a scope change: the flaw sits in SDP but successful attacks significantly impact other products co-hosted in the WebLogic domain. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the low attack complexity over a network-facing T3/IIOP surface makes it a high-priority patch.
Complete takeover of Oracle Communications/Fusion Middleware Service Delivery Platform (versions 12.2.1.4.0 and 14.1.2.0.0, Messaging Enabler component) is possible by an unauthenticated remote attacker reaching the T3 or IIOP protocol. The flaw scores CVSS 3.1 9.8 with full confidentiality, integrity, and availability impact and requires no user interaction; no public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the T3/IIOP attack surface historically maps to WebLogic-style deserialization abuse. It was self-reported by Oracle and disclosed in the July 2026 Critical Patch Update.
Complete takeover of Oracle Communications Service Delivery Platform (Messaging Enabler component) versions 12.2.1.4.0 and 14.1.2.0.0 is possible by an unauthenticated remote attacker reaching the server over the T3 or IIOP protocols. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N, full C/I/A impact), placing it among Oracle's most severe July 2026 Critical Patch Update fixes. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the T3/IIOP attack surface has a long history of trivially weaponized deserialization exploits.
Complete takeover of Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) is achievable by an unauthenticated remote attacker who reaches the T3 or IIOP protocol endpoints. Versions 12.2.1.4.0 and 14.1.2.0.0 are affected, carrying a maximum-severity CVSS 9.8 with full confidentiality, integrity, and availability loss. No public exploit is identified at time of analysis and the CVE is not in CISA KEV, but the T3/IIOP attack surface is historically a high-value target in the Oracle WebLogic/Fusion stack.
Unauthenticated remote data compromise affects Oracle Service Delivery Platform 14.1.2.0.0 via its Messaging Enabler component, reachable over HTTP without credentials. The authentication bypass allows network attackers to read a subset of platform data and perform unauthorized insert, update, or delete operations against accessible data stores. No public exploit code or active exploitation has been identified at time of analysis, and Oracle addressed this in the August 2026 Critical Patch Update.
Unauthorized confidential data access in Oracle Service Delivery Platform (Fusion Middleware, Messaging Enabler component) is achievable by network-adjacent high-privileged attackers over HTTP, with a scope change that can impact additional Fusion Middleware products beyond the primary target. Affected versions are 14.1.2.0.0 and 12.2.1.4.0. Classified as 'easily exploitable' by Oracle, the flaw carries a CVSS 3.1 score of 6.8 with scope change flagged - though no public exploit code or CISA KEV listing has been identified at time of analysis.
Oracle Service Delivery Platform's Messaging Enabler component in versions 12.2.1.4.0 and 14.1.2.0.0 allows low-privileged local users to perform unauthorized read and write operations on platform data, with a documented scope change that extends impact to additional co-deployed Oracle Fusion Middleware products. The vulnerability requires only a low-privileged local account on the hosting infrastructure, making insider threats and compromised service accounts the primary risk vector. No public exploit has been identified at time of analysis; this was disclosed as part of Oracle's July 2026 Critical Patch Update.