Security readout for executives and security teams
Plain-English summary
A low-privileged attacker who can reach Oracle Service Delivery Platform through Oracle Net may read, create, alter, or delete critical accessible data. The flaw can also affect connected products beyond the vulnerable component. No user interaction is required, making exposed affected deployments an urgent confidentiality and integrity risk.
Executive priority
Treat as an immediate remediation priority for affected, reachable systems. The principal business risk is broad theft or manipulation of critical data, potentially extending into integrated products. Ask owners to establish version, reachability, data sensitivity, and vendor-remediation status promptly.
Technical view
CVE-2026-60861 is an access-control vulnerability, categorized as CWE-284, in Oracle Fusion Middleware Service Delivery Platform’s Messaging Enabler. Versions 14.1.2.0.0 and 12.2.1.4.0 are affected. The CVSS 3.1 vector indicates network access, low complexity, low privileges, no interaction, changed scope, high confidentiality and integrity impact, and no scored availability impact.
Likely exposure
Exposure is most likely where an affected Service Delivery Platform version is reachable through Oracle Net by low-privileged accounts. Internet exposure is not established by the supplied evidence. Risk also depends on accessible data and integrations because successful compromise may significantly affect additional products.
Exploitation context
Oracle describes the vulnerability as easily exploitable, but exploitation still requires low privileges and Oracle Net connectivity. The supplied record is not in CISA KEV, and no cited source establishes active exploitation, public exploit availability, or observed attacks.
Researcher notes
The changed-scope rating is significant: impact may cross the vulnerable Service Delivery Platform security boundary into additional products. The record attributes the issue to improper authorization but provides no root-cause detail, attack telemetry, patch identifier, or proof-of-concept information. Availability impact is scored as none, although destructive modification or deletion of data remains explicitly described.
Mitigation direction
- Consult Oracle’s advisory for current vendor-prescribed updates or mitigations.
- Prioritize affected systems reachable through Oracle Net, especially those handling critical data.
- Restrict Oracle Net access to trusted networks and necessary systems where operationally feasible.
- Review and minimize privileges for accounts able to access the affected service.
- Monitor affected environments for unauthorized data access or modification.
Validation and detection
- Inventory Service Delivery Platform installations and confirm their exact versions.
- Identify whether versions 14.1.2.0.0 or 12.2.1.4.0 are deployed.
- Map Oracle Net reachability from user, server, partner, and untrusted network segments.
- Review low-privileged accounts and determine what Service Delivery Platform data they can access.
- Confirm vendor-prescribed remediation is applied using Oracle’s published verification guidance.
- Examine audit records for unexpected creation, deletion, modification, or access to critical data.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-284: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-60861 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.6 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N3.15.8oracleVulnerability scoring details
Base CVSS 3.1 score
9.6CriticalVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- Oracle AdvisoryCVE reference, oracle · vendor-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Access Control
Improper Access Control represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.