CVE-2026-60442 is a vulnerability in Oracle Fusion Middleware's Service Delivery Platform Messaging Enabler component. It affects versions 12.2.1.4.0 and 14.1.2.0.0. The flaw allows unauthenticated attackers with network access via T3 and IIOP protocols to compromise the platform, potentially resulting in full system takeover. The vulnerability has a CVSS 3.1 base score of 9.8, reflecting critical impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not explicitly confirm patch availability or remediation status for this specific issue. Customers are urged to stay on supported versions and apply security patches without delay.

Successful exploitation of this vulnerability can lead to complete compromise of the Oracle Service Delivery Platform, affecting confidentiality, integrity, and availability of the system. An unauthenticated attacker with network access via T3 or IIOP protocols can take over the platform, which may result in unauthorized control and potential disruption of services.

Oracle's July 2026 Critical Patch Update advisory includes security patches for multiple vulnerabilities, including this one. However, explicit patch availability or remediation details for CVE-2026-60442 are not confirmed in the advisory content provided. Customers should promptly review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply all relevant patches for their affected products and versions. Staying on actively supported versions and applying security patches without delay is strongly recommended by Oracle. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.