This vulnerability (CVE-2026-60384) exists in the Messaging Enabler component of Oracle Fusion Middleware's Service Delivery Platform. It permits an unauthenticated attacker with network access via T3 or IIOP protocols to compromise the platform, potentially resulting in complete takeover. The CVSS 3.1 score of 9.8 reflects critical impact across confidentiality, integrity, and availability. Affected versions explicitly include 12.2.1.4.0 and 14.1.2.0.0. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not provide explicit patch or remediation details for these versions in the extracted advisory content. The vendor strongly recommends applying security patches promptly, though patch status for this specific vulnerability is not confirmed in the provided data.

Successful exploitation allows an unauthenticated remote attacker with network access via T3 or IIOP to fully compromise the Oracle Service Delivery Platform. This results in complete loss of confidentiality, integrity, and availability of the affected system, effectively enabling total platform takeover.

Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation status for the affected versions 12.2.1.4.0 and 14.1.2.0.0 in the provided content. Customers are strongly advised to review the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Applying the latest security patches promptly is recommended to mitigate this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.