CVE-2026-60379 is an easily exploitable vulnerability in Oracle Fusion Middleware's Service Delivery Platform Messaging Enabler component. It allows unauthenticated attackers with network access via SOAP to compromise the Service Delivery Platform, potentially leading to full takeover. The vulnerability affects versions 12.2.1.4.0 and 14.1.2.0.0. The CVSS 3.1 score of 10.0 reflects critical impact on confidentiality, integrity, and availability. Although Oracle has released a Critical Patch Update in July 2026 covering many vulnerabilities, the advisory does not explicitly confirm a patch or remediation level for this specific CVE. The vulnerability's scope change means exploitation may affect other Oracle products integrated with the Service Delivery Platform.

Successful exploitation of this vulnerability can result in complete takeover of the Oracle Service Delivery Platform, compromising confidentiality, integrity, and availability of the platform. Due to scope change, additional Oracle products relying on the Service Delivery Platform may also be significantly impacted. This represents a critical risk to affected environments.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to the Service Delivery Platform SOAP interface to trusted entities only.