This vulnerability in Oracle Fusion Middleware's Service Delivery Platform Messaging Enabler component allows a low privileged attacker with network access via Oracle Net to compromise the platform. The attack scope may extend beyond the Service Delivery Platform to other products. Exploitation can result in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by the Service Delivery Platform. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality and integrity impact.

Successful exploitation enables unauthorized creation, deletion, or modification of critical data within the Service Delivery Platform, potentially extending to other products due to scope change. This compromises confidentiality and integrity of data accessible by the platform. There is no impact on availability. The vulnerability is critical with a CVSS score of 9.6.

Oracle has released security patches addressing this vulnerability as part of its August 2026 Critical Security Patch Update. Customers are strongly advised to apply the available patches promptly to mitigate this vulnerability. Oracle recommends remaining on actively-supported versions and applying security patches without delay. Patch status is confirmed as available via Oracle's official advisory.