Vulnary
← back to the feed
Critical· 9.8

CVE-2026-60386

CVE-2026-60386 is a critical vulnerability in Oracle Fusion Middleware's Service Delivery Platform (versions 12.2.1.4.0 and 14.1.2.0.0). Unauthenticated attackers can exploit it via HTTP to take over the service, compromising confidentiality, integrity, and availability. The CVSS score is 9.8, indicating high severity.

publishedJul 21, 2026
last modifiedJul 28, 2026
sourcesNVD
severity · cvss
9.8
critical · how bad it is
exploitation · epss
<1%
38th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Sep 4, 2026

No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.

01

Who is affected

Users of Oracle Fusion Middleware Service Delivery Platform versions 12.2.1.4.0 and 14.1.2.0.0.

02

Real-world impact

Attackers can take control of the Service Delivery Platform without authentication, leading to full system compromise.

03

Why this severity

CVSS 9.8 (critical): High impact on confidentiality, integrity, and availability.

04

What to do about it

no official fix yet
interim mitigations
  • ›Restrict HTTP access to the Service Delivery Platform to only necessary networks or IP ranges.
  • ›Implement network segmentation to isolate the service from untrusted environments.
  • ›Monitor for unusual HTTP traffic patterns or unauthorized access attempts.

No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.

No fix documented in provided sources (NVD description does not specify a patch or CISA KEV action).

05

Timeline

  1. Jul 21, 2026 · 11d ago
    Published
    Disclosed and added to the National Vulnerability Database.
  2. Jul 28, 2026 · 4d ago
    Advisory updated
    The NVD record was last revised.
06

How it’s attacked

Attack vectorNetwork (remote)
Attack complexityLow
Privileges requiredNone
User interactionNone needed
ScopeUnchanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
07

References & advisories

NVD advisory ↗Search advisories ↗
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →