CVE-2026-60376 is a vulnerability in Oracle Fusion Middleware's Service Delivery Platform Messaging Enabler component. It affects versions 12.2.1.4.0 and 14.1.2.0.0. The flaw allows an unauthenticated attacker with network access via T3 and IIOP protocols to compromise the platform, resulting in full takeover. The CVSS 3.1 score is 9.8, indicating critical severity with impacts on confidentiality, integrity, and availability. The vendor advisory from Oracle references a Critical Patch Update in July 2026 but does not explicitly confirm a patch or remediation for this vulnerability in the provided text. Oracle strongly recommends applying available patches and remaining on supported versions to mitigate exploitation risks.

Successful exploitation of this vulnerability allows an unauthenticated attacker with network access via T3 or IIOP to fully compromise the Oracle Service Delivery Platform. This can lead to complete takeover of the platform, impacting confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying security patches promptly and remaining on actively supported versions. No explicit patch or temporary fix for this vulnerability is confirmed in the provided advisory content.