This vulnerability (CVE-2026-60380) exists in the Messaging Enabler component of Oracle Fusion Middleware's Service Delivery Platform. It allows an unauthenticated attacker with network access over HTTP to compromise the platform, leading to full takeover. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates that the attack requires no privileges or user interaction and can be executed remotely with low complexity. The affected versions explicitly stated are 12.2.1.4.0 and 14.1.2.0.0. Oracle's July 2026 Critical Patch Update advisory mentions this vulnerability but does not provide explicit patch or remediation details for it. The advisory strongly recommends applying patches promptly but does not confirm if a patch for this specific vulnerability is included or available.

Successful exploitation allows an unauthenticated remote attacker to fully compromise the Oracle Service Delivery Platform, impacting confidentiality, integrity, and availability. This can lead to complete takeover of the affected system, posing a critical risk to organizations using the affected versions.

Oracle's July 2026 Critical Patch Update advisory references this vulnerability within a large set of patched issues and strongly recommends applying security patches without delay. However, the advisory does not explicitly confirm the availability of a specific patch for CVE-2026-60380. Organizations should review the Oracle Critical Patch Update documentation at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Until a confirmed patch is applied, limit network exposure of the Service Delivery Platform and monitor for unusual activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.