CVE-2026-60382 is a vulnerability in Oracle Fusion Middleware's Service Delivery Platform Messaging Enabler component. It allows an unauthenticated remote attacker to cause a denial of service by triggering a hang or repeated crash of the platform via HTTP network access. The vulnerability affects versions 12.2.1.4.0 and 14.1.2.0.0. The CVSS 3.1 vector indicates low attack complexity, no privileges or user interaction required, and impact limited to availability (score 7.5). Oracle's July 2026 Critical Patch Update advisory mentions many patches but does not explicitly confirm a patch or remediation for this vulnerability. No known exploits in the wild have been reported.

Successful exploitation results in a complete denial of service (DoS) of the Oracle Service Delivery Platform, causing the service to hang or crash repeatedly. There is no impact on confidentiality or integrity. The attack requires only network access via HTTP and no authentication, making it easily exploitable. This can disrupt availability of services relying on the platform.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly on actively-supported versions. Until a patch is confirmed and applied, consider restricting network access to the affected Service Delivery Platform instances to trusted sources only to reduce exposure.