CVE-2026-60440 is a vulnerability in Oracle Fusion Middleware's Service Delivery Platform Messaging Enabler component. It affects versions 12.2.1.4.0 and 14.1.2.0.0. The flaw allows a low privileged attacker with network access via HTTP to compromise the Service Delivery Platform, resulting in unauthorized access to critical or all accessible data. The vulnerability has a CVSS 3.1 score of 7.7 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, indicating network attack vector, low attack complexity, low privilege required, no user interaction, scope changed, and high confidentiality impact. Oracle's July 2026 Critical Patch Update advisory mentions this vulnerability but does not explicitly state patch availability or remediation details for it. No known exploits have been reported.

Successful exploitation of this vulnerability can lead to unauthorized access to critical data or complete access to all data accessible via the Service Delivery Platform. The confidentiality impact is high, but integrity and availability are not affected. The vulnerability affects the Service Delivery Platform and may impact additional products due to scope change.

Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not explicitly confirm patch availability or remediation status for CVE-2026-60440. Customers are strongly advised to review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch information and apply security patches promptly. Until explicit patch information is confirmed, monitor Oracle advisories for updates. No vendor advisory states that no action is required or that the issue is already mitigated.