CVE-2026-60377 is a vulnerability in Oracle Fusion Middleware's Service Delivery Platform Messaging Enabler component. It affects versions 12.2.1.4.0 and 14.1.2.0.0. The vulnerability allows a low privileged attacker with network access via T3 or IIOP protocols to compromise the platform, resulting in unauthorized creation, deletion, or modification of critical data, unauthorized access to all accessible data, and the ability to cause a partial denial of service. The vulnerability has a CVSS 3.1 score of 9.9 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L, indicating network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality and integrity impact with low availability impact. The vendor advisory is a general Critical Patch Update advisory from Oracle dated July 2026, which includes many patches but does not explicitly confirm a patch for this vulnerability in the provided text. No known exploits in the wild are reported.

Successful exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical data within the Service Delivery Platform. Attackers may gain unauthorized access to all data accessible by the platform and cause partial denial of service conditions. The vulnerability affects confidentiality, integrity, and availability, with a CVSS score of 9.9 indicating critical impact. The scope of the vulnerability extends beyond the Service Delivery Platform to potentially impact additional Oracle products that rely on it.

Oracle has published a Critical Patch Update advisory in July 2026 that addresses multiple vulnerabilities including this one. However, the provided advisory content does not explicitly confirm the availability of a patch or fix for CVE-2026-60377. Customers are strongly advised to review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Until a patch is confirmed and applied, organizations should consider restricting network access to T3 and IIOP protocols to trusted users only and monitor for suspicious activity related to the Service Delivery Platform. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.