This vulnerability in Oracle Service Delivery Platform's Messaging Enabler component allows unauthenticated remote attackers to exploit network access via T3 and IIOP protocols to fully compromise the platform. The flaw affects versions 12.2.1.4.0 and 14.1.2.0.0. The CVSS 3.1 score of 9.8 reflects critical severity with impacts on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory references multiple security patches across products but does not explicitly confirm a patch for this specific CVE. No known exploits in the wild have been reported. The vulnerability is identified as CWE-306 (Missing Authentication for Critical Function).

Successful exploitation allows an unauthenticated attacker with network access via T3 or IIOP to take over the Oracle Service Delivery Platform, compromising confidentiality, integrity, and availability of the system. This can lead to full control of the affected platform, posing severe operational and security risks.

Oracle has released a Critical Patch Update advisory in July 2026 addressing numerous vulnerabilities. Although the advisory does not explicitly confirm a patch for CVE-2026-60441, customers should promptly review and apply the relevant patches from the advisory to mitigate this vulnerability. Staying on actively supported versions and applying Oracle patches without delay is strongly recommended. Patch status is not yet confirmed explicitly for this CVE—check the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest remediation guidance.