This vulnerability in Oracle Fusion Middleware's Service Delivery Platform Messaging Enabler allows an unauthenticated attacker to exploit the system remotely over HTTP without any privileges or user interaction. The flaw leads to a complete compromise of the Service Delivery Platform, impacting confidentiality, integrity, and availability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms the ease of exploitation and critical impact. The affected versions are 12.2.1.4.0 and 14.1.2.0.0. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not explicitly confirm a patch or remediation level for it. No known exploits in the wild have been reported at this time.

Successful exploitation allows an unauthenticated attacker with network access to take over the Oracle Service Delivery Platform, resulting in full compromise of confidentiality, integrity, and availability of the affected system. This could lead to unauthorized access, data breaches, service disruption, and complete control over the platform.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the advisory does not explicitly confirm the availability of a patch or remediation for this specific vulnerability. Customers are strongly advised to review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch information and apply all relevant security updates promptly. Until a patch is confirmed and applied, restrict network access to the Service Delivery Platform where possible to reduce exposure.