This vulnerability in Oracle Fusion Middleware's Service Delivery Platform Messaging Enabler allows an unauthenticated attacker to remotely compromise the platform via HTTP. The affected versions are 12.2.1.4.0 and 14.1.2.0.0. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory includes this vulnerability among many others but does not explicitly confirm patch availability or remediation level for these specific versions in the provided text.

Successful exploitation allows an unauthenticated attacker with network access to fully compromise the Service Delivery Platform, resulting in complete takeover. This impacts confidentiality, integrity, and availability of the affected system, representing a critical security risk.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the provided advisory content does not explicitly confirm patch availability or remediation status for the affected versions 12.2.1.4.0 and 14.1.2.0.0. Users should consult the official Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch information and apply any relevant patches promptly. Until patches are confirmed and applied, restrict network access to the Service Delivery Platform where possible to reduce exposure.