This vulnerability (CVE-2026-60375) exists in the Messaging Enabler component of Oracle Fusion Middleware's Service Delivery Platform. It allows an unauthenticated attacker with network access via T3 and IIOP protocols to compromise the platform. The vulnerability is easily exploitable and can lead to complete takeover of the Service Delivery Platform. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. Affected versions explicitly include 12.2.1.4.0 and 14.1.2.0.0. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly state patch availability or remediation status for these versions in the provided content.

Successful exploitation allows an unauthenticated attacker with network access to fully compromise the Service Delivery Platform, resulting in complete loss of confidentiality, integrity, and availability of the affected system. This can lead to full platform takeover.

Oracle's July 2026 Critical Patch Update advisory references this vulnerability as part of a large set of security patches. However, the provided advisory content does not explicitly confirm patch availability or remediation status for the affected versions 12.2.1.4.0 and 14.1.2.0.0 of the Service Delivery Platform. Therefore, patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying all relevant security patches without delay and remaining on actively supported versions.