This vulnerability in Oracle Service Delivery Platform Messaging Enabler permits unauthenticated remote attackers to exploit network access via T3 and IIOP protocols to compromise the platform. The flaw affects versions 12.2.1.4.0 and 14.1.2.0.0 and carries a CVSS 3.1 score of 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating it is remotely exploitable without privileges or user interaction and results in high confidentiality, integrity, and availability impacts. The vendor advisory references the July 2026 Critical Patch Update but does not explicitly confirm a patch or remediation level for this specific vulnerability. No known exploits in the wild have been reported.

An attacker with network access can remotely exploit this vulnerability without authentication to fully compromise the Service Delivery Platform. This leads to complete loss of confidentiality, integrity, and availability of the affected system, potentially allowing full takeover.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until a patch is confirmed and applied, restrict network access to T3 and IIOP protocols to trusted sources only.