CVE-2026-60389
CVE-2026-60389 is a critical vulnerability (CVSS 10.0) in Oracle Fusion Middleware's Service Delivery Platform, specifically the Messaging Enabler component. It affects versions 12.2.1.4.0 and 14.1.2.0.0 and can be exploited by an unauthenticated attacker over HTTP, leading to full takeover of the platform and potential impact on other products due to a scope change.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Oracle Fusion Middleware Service Delivery Platform versions 12.2.1.4.0 and 14.1.2.0.0
Real-world impact
Successful exploitation allows an unauthenticated network attacker to compromise the Service Delivery Platform, potentially resulting in complete takeover and affecting other linked products.
Why this severity
The CVSS v3.1 base score of 10.0 reflects the highest possible severity, with high impacts to confidentiality, integrity, and availability, low attack complexity, no privileges or user interaction required, and a scope change that can affect additional components.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jul 21, 2026 · 11d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 31, 2026 · 22h agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- oracle.com/security-alerts/cpujul2026.…vendor advisory