External risk intelligence

Oracle Fusion Middleware Messaging Enabler Takeover Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-60378

The vulnerability affects a Service Delivery Platform component reachable via HTTP without authentication. Such platforms are typically deployed as internet-facing gateways or service endpoints to facilitate communication, making them public-facing by design in normal operations.

Missing Authentication

Oracle Service Delivery Platform

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Oracle Fusion Middleware's Service Delivery Platform, which could allow an unauthenticated attacker to gain complete control of the platform. This issue affects how the platform handles messages and has a high impact on confidentiality, integrity, and availability. The main concern is confirming if our environment utilizes this specific component and understanding the potential exposure.

Unauthenticated access can fully control the platform.
Critical exposure for messaging and delivery platforms.
Confirm relevance and assess potential impact.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can target Oracle Fusion Middleware's Service Delivery Platform by sending network requests over HTTP. This could lead to a complete takeover of the platform, allowing the attacker to access, modify, or delete sensitive data and disrupt operations.

Requires unauthenticated network access.
Attacker triggers vulnerability via HTTP.
Risk of complete platform takeover.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker with network access could compromise the Service Delivery Platform, potentially leading to a complete takeover of the system. This vulnerability impacts confidentiality, integrity, and availability of the platform.

Service Delivery Platform data and functionality at risk.
Exposure could happen via unauthenticated network access.
Realistic consequence is a full system takeover.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Oracle Fusion Middleware Service Delivery Platform is likely managed by a platform or infrastructure team, with the network and security teams responsible for its exposure and access control. The immediate priority is to identify all instances of the affected Service Delivery Platform, assess their network reachability and business criticality, and then confirm the accountable owner to plan remediation activities.

Platform or infrastructure teams own remediation.
Verify network exposure and asset criticality.
Coordinate vendor updates and plan maintenance.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Oracle Fusion Middleware Messaging Enabler?

The Messaging Enabler is a specialized component within the Oracle Fusion Middleware Service Delivery Platform. Organizations use this platform to manage, route, and deliver messages across complex enterprise environments. It acts as a central hub for handling communication flows, ensuring that data is correctly routed between various internal and external services. By managing these message exchanges, it supports the reliable operation of interconnected business applications.

How does CVE-2026-60378 allow for a system takeover?

This vulnerability represents a critical security weakness where the platform fails to properly validate requests. Because the software does not require authentication to process certain inputs, an attacker can send malicious HTTP commands that the system executes. This flaw allows a remote user to bypass security controls entirely, effectively gaining the same level of administrative power as a legitimate system operator to access or modify data.

Do I need to be logged in to trigger this vulnerability?

No, you do not need to be logged in. The vulnerability is triggered by an unauthenticated attacker, meaning no valid user account or password is required to initiate the attack. Simply having network access to the target HTTP interface is sufficient to send the malicious requests. The flaw is not limited to specific actions inside an established session; it is accessible to anyone who can reach the service over the network.

Why is this CVE considered an external-facing threat?

According to Halo Surface Signal, this software is often configured as an internet-facing gateway or service endpoint to bridge communications. Because it is designed to accept inbound HTTP requests, the attack surface is naturally exposed to the public internet. If your instance of the Service Delivery Platform is reachable from outside your corporate network, it is at higher risk than services restricted strictly to internal traffic.

When should I prioritize patching this system?

You should prioritize this immediately, as the vulnerability carries a critical risk of full system compromise. Your first step is to perform an inventory to locate all instances of the affected software versions in your environment. Once identified, evaluate their network exposure and business impact. Coordinate with your infrastructure and security teams to apply the necessary vendor-provided updates to secure your platform against unauthorized access.

References

www.oracle.com/security-alerts/cpujul2026.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.