Security readout for executives and security teams
Plain-English summary
This is a critical Oracle Service Delivery Platform flaw that can let an unauthenticated attacker take over the product through HTTP network access. The affected supported versions are 12.2.1.4.0 and 14.1.2.0.0. Business risk is high where SDP is reachable from untrusted networks.
Executive priority
Treat this as urgent for any internet-facing or broadly reachable SDP deployment. A successful attack could fully compromise the platform, affecting confidentiality, integrity, and availability.
Technical view
CVE-2026-60380 affects Oracle Fusion Middleware Service Delivery Platform, Messaging Enabler component. Oracle rates it CVSS 9.8 with AV:N/AC:L/PR:N/UI:N and high confidentiality, integrity, and availability impact. The source bundle does not provide CWE details, exploit mechanics, or specific patch identifiers.
Likely exposure
Organizations running Oracle Service Delivery Platform 12.2.1.4.0 or 14.1.2.0.0 are potentially exposed, especially if HTTP access to Messaging Enabler is reachable from external or broad internal networks.
Exploitation context
The CVE states exploitation is easy and requires only unauthenticated HTTP network access. The bundle does not cite active exploitation, and KEV status is false, so active in-the-wild exploitation is not established here.
Researcher notes
Evidence is limited to the CVE record and Oracle advisory reference. No CWE, root cause, endpoint detail, indicators, or exploit status are provided in the bundle. Avoid assuming affected products beyond Oracle SDP Messaging Enabler versions listed.
Mitigation direction
- Check Oracle July 2026 CPU guidance for SDP-specific patches and apply vendor-approved updates.
- Restrict HTTP access to Service Delivery Platform from untrusted networks immediately.
- Place affected SDP interfaces behind allowlists, VPN, or equivalent access controls.
- Increase monitoring for suspicious HTTP activity against SDP Messaging Enabler endpoints.
- Prioritize compensating controls if vendor patching cannot occur quickly.
Validation and detection
- Inventory Oracle Service Delivery Platform deployments and confirm exact installed versions.
- Identify any 12.2.1.4.0 or 14.1.2.0.0 instances.
- Confirm whether Messaging Enabler HTTP interfaces are reachable from untrusted networks.
- Review Oracle CPU guidance for remediation applicability to each affected instance.
- Verify post-remediation version or patch status using vendor-supported methods.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-60380 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9oracleVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- Oracle AdvisoryCVE reference, oracle · vendor-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.