CVE-2026-60861 is a vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware, affecting Messaging Enabler in versions 14.1.2.0.0 and 12.2.1.4.0. It allows a low privileged attacker with network access via Oracle Net to compromise the platform. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full access to all data accessible by the Service Delivery Platform. The vulnerability has a CVSS 3.1 base score of 9.6 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, indicating network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality and integrity impact without availability impact. Oracle’s August 2026 Critical Security Patch Update advisory mentions this vulnerability among 943 patches but does not explicitly confirm patch availability or remediation level for this specific issue.

The vulnerability allows an attacker with low privileges and network access to compromise the Service Delivery Platform, potentially resulting in unauthorized creation, deletion, or modification of critical data. The scope of impact may extend to additional Oracle products connected to the platform. The confidentiality and integrity of data are highly impacted, while availability is not affected. This could lead to significant data breaches or manipulation within affected environments.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability among many others. Customers are strongly advised to remain on actively supported versions and apply Oracle’s security patches promptly. Patch status for this specific vulnerability is not explicitly stated in the advisory content provided; therefore, users should consult the official Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for the latest patch availability and installation instructions. No vendor advisory states that no action is required or that the issue is already mitigated, so patching is recommended once confirmed.