CVE-2026-60389 is an easily exploitable vulnerability in Oracle Fusion Middleware's Service Delivery Platform Messaging Enabler component. It allows an unauthenticated attacker with network access over HTTP to take over the Service Delivery Platform. The vulnerability affects versions 12.2.1.4.0 and 14.1.2.0.0. The attack surface includes network access without authentication, and the vulnerability has a CVSS 3.1 score of 10.0, indicating critical impact on confidentiality, integrity, and availability. The vulnerability's scope change means that exploitation may affect additional Oracle products beyond the Service Delivery Platform itself. Oracle's Critical Patch Update advisory for July 2026 references this vulnerability but does not explicitly confirm the availability of a patch or remediation level for it. Customers are strongly advised to remain on supported versions and apply patches as they become available.

Successful exploitation of CVE-2026-60389 results in complete takeover of the Oracle Service Delivery Platform, leading to full compromise of confidentiality, integrity, and availability of the affected system. Due to scope change, additional Oracle products integrated with or dependent on the Service Delivery Platform may also be significantly impacted. The vulnerability requires no authentication and can be exploited remotely over HTTP, increasing the risk of widespread impact.

Patch status is not yet confirmed — check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends customers remain on actively supported versions and apply security patches promptly once available. Until a patch is confirmed, restrict network access to the Service Delivery Platform where possible to limit exposure.