External risk intelligence

Oracle Fusion Middleware Service Delivery Platform Messaging Enabler Vulnerability Affects Data and Availability

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-60377

The vulnerability affects Oracle Fusion Middleware's Messaging Enabler via T3 and IIOP protocols. These are often used for internal server connectivity rather than direct public exposure. While network access is required, deployment patterns vary, making internet reachability possible but not the standard configuration for this component.

Denial of Service

Oracle Service Delivery Platform

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Oracle Fusion Middleware's Service Delivery Platform, specifically affecting its Messaging Enabler component. This issue is easily exploitable by an attacker with limited privileges who can access the system over a network. Successful exploitation could lead to unauthorized access, modification, or deletion of critical data, and could also cause a partial denial of service, potentially impacting other connected products.

A flaw in Oracle's Service Delivery Platform.
May impact sensitive data and system availability.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker with limited privileges could exploit this vulnerability by accessing the Service Delivery Platform over a network using T3 or IIOP protocols. This could lead to unauthorized data modification or deletion, unauthorized data access, or a partial denial of service. The impact extends beyond the Service Delivery Platform itself, potentially affecting other Oracle Fusion Middleware products.

Low-privileged network access required.
Attacker targets the Messaging Enabler component.
Risks include data compromise and partial denial of service.

Live Threat

Current exploitation, exposure, and threat context

A low-privileged attacker with network access could exploit a vulnerability in Oracle Fusion Middleware's Service Delivery Platform. This could lead to unauthorized modification or access to critical data, or a partial denial of service.

Critical data or all accessible data.
Network access via T3, IIOP protocols.
Unauthorized data access or modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Oracle Fusion Middleware Service Delivery Platform is likely managed by an infrastructure or platform team, with oversight from a vendor-management team due to its Oracle origin. The immediate priority is to locate all instances of the affected technology, confirm their business criticality and network exposure, and identify the accountable system owner to plan a risk-based remediation strategy.

Identify platform or infrastructure team ownership.
Verify business criticality and network reachability.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Oracle Fusion Middleware Service Delivery Platform?

It is a complex software framework designed to help service providers build, deploy, and manage communication services. The specific Messaging Enabler component functions as a communication layer, allowing different parts of the system to exchange data. It is widely used in enterprise environments to facilitate connectivity and integration across various business applications and middleware services.

What does CVE-2026-60377 mean for data security?

This vulnerability represents a significant security weakness that allows unauthorized actors to bypass standard protections. Because it impacts data integrity and confidentiality, a successful attack could allow someone to view, change, or delete sensitive information stored within the platform. The scope of this issue is broad, meaning the impact is not limited to the messaging component alone but can extend to other connected products within the Fusion Middleware environment.

How is this vulnerability triggered by an attacker?

An attacker needs network access to the target system to initiate the exploit. Specifically, they utilize the T3 or IIOP communication protocols to interact with the Messaging Enabler. It is important to note that this bug does not trigger through standard web browser interactions or basic user-level actions; it requires the ability to communicate directly with the middleware services over the network using these specific technical protocols.

Is my system at risk if it isn't directly on the internet?

According to Halo Surface Signal, while the vulnerability requires network access, it targets T3 and IIOP protocols often reserved for internal server-to-server connectivity. This means public internet exposure is not the standard configuration, but the risk remains if an attacker has any footprint inside your network. You should prioritize assets where these protocols are active, even if they are not directly reachable from the open web.

What should I do first to manage this CVE-2026-60377 risk?

Start by identifying every instance of the Service Delivery Platform running in your environment. Collaborate with your platform or infrastructure teams to determine which servers are currently utilizing the Messaging Enabler component. Once these are located, verify their network reachability and business criticality to help your organization plan an appropriate, risk-based maintenance schedule to secure the affected infrastructure.

References

www.oracle.com/security-alerts/cpujul2026.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.