CVE-2026-60860 is a vulnerability in the Messaging Enabler component of Oracle Fusion Middleware's Service Delivery Platform. It permits an unauthenticated attacker with network access via TCP to compromise the platform, resulting in unauthorized modification of critical data and the ability to cause hangs or repeated crashes leading to denial of service. The vulnerability has a CVSS 3.1 base score of 8.7, with attack vector network, high attack complexity, no privileges required, no user interaction, and scope change. Affected versions explicitly include 14.1.2.0.0 and 12.2.1.4.0. Oracle's August 2026 Critical Security Patch Update includes fixes for this vulnerability among 943 patches across multiple products. Oracle strongly recommends applying these patches without delay to mitigate exploitation risks.

Exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical data within the Service Delivery Platform. Additionally, it can cause denial of service conditions by hanging or crashing the platform repeatedly. The vulnerability affects the integrity and availability of the system. There is no indication of confidentiality impact. The vulnerability scope extends beyond the Service Delivery Platform to potentially impact additional Oracle products.

Oracle has released a Critical Security Patch Update in August 2026 that includes a fix for this vulnerability. Customers should apply the official patches provided by Oracle promptly to remediate this issue. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or temporary fixes are indicated in the advisory.