This vulnerability in Oracle's Service Delivery Platform Messaging Enabler component allows a high privileged attacker with network access via HTTP to compromise the platform. Successful exploitation can result in unauthorized access to critical or all data accessible through the Service Delivery Platform. The vulnerability affects versions 14.1.2.0.0 and 12.2.1.4.0. It has a CVSS 3.1 score of 6.8 with a vector indicating network attack vector, low attack complexity, high privileges required, no user interaction, scope change, and high confidentiality impact without integrity or availability impact. Oracle's August 2026 Critical Security Patch Update includes patches for this vulnerability among 943 others, and Oracle strongly recommends applying these patches promptly.

Exploitation of this vulnerability can lead to unauthorized access to critical data or complete access to all data accessible via the Service Delivery Platform. The scope of impact may extend beyond the Service Delivery Platform to other Oracle products. The vulnerability requires a high privileged attacker with network access via HTTP but does not require user interaction. The confidentiality impact is high, while integrity and availability impacts are not affected.

Oracle has released security patches addressing this vulnerability in their August 2026 Critical Security Patch Update. Customers should apply these patches without delay to mitigate the vulnerability. Oracle strongly recommends remaining on actively-supported versions and promptly applying all relevant security patches. Patch status is confirmed as available via the Oracle advisory.