External risk intelligence

Oracle Fusion Middleware Service Delivery Platform SOAP Takeover Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-60379

The vulnerability affects a Service Delivery Platform component that utilizes SOAP for communication and is reachable by unauthenticated attackers over the network. Such platforms are designed to act as gateways or service endpoints, making them inherently public-facing or exposed to external network traffic in standard deployments.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Oracle Fusion Middleware's Service Delivery Platform, which could allow an unauthenticated attacker to gain complete control of the platform. The issue is easily exploitable remotely and, despite being in one component, may impact other connected products.

Unauthenticated network access compromises the platform.
It enables significant external impact on connected systems.
Confirm relevance and exposure to associated business functions.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker with network access can exploit this vulnerability by sending a crafted SOAP message to the Service Delivery Platform. This targeted message exploits a weakness in the Messaging Enabler component, potentially allowing the attacker to take control of the platform and affect other connected products.

Network access required.
Triggered via SOAP message.
Leads to platform takeover.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker with network access via SOAP could potentially take over Oracle Fusion Middleware's Service Delivery Platform. This could impact additional products beyond the Service Delivery Platform itself.

Service Delivery Platform data and functionality.
Network access via SOAP protocols.
Complete takeover of the platform.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Oracle Fusion Middleware's Service Delivery Platform requires immediate attention from teams managing Oracle products, infrastructure, and security. The first step is to identify all instances of the affected product, confirm their network accessibility and business criticality, and then assign an owner to coordinate remediation efforts.

Application or platform owners should lead.
Verify network exposure and impact.
Plan coordinated remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Oracle Fusion Middleware Service Delivery Platform?

The Service Delivery Platform is a component within the Oracle Fusion Middleware suite designed to facilitate communications and service management. It often acts as a bridge or gateway, enabling different systems to interact and exchange data. The Messaging Enabler, a specific part of this platform, manages these message exchanges, which is where this security issue resides.

What does this vulnerability mean for CVE-2026-60379?

This vulnerability represents a flaw in how the Messaging Enabler handles incoming communications. Because it is a high-severity issue, it indicates a breakdown in the software's ability to safely process data, potentially allowing an unauthorized user to bypass security controls and gain full control over the platform's functions and data.

How is this vulnerability triggered?

An attacker triggers the vulnerability by sending a specifically crafted SOAP message to the Messaging Enabler component. Because the system is designed to process these messages, it does not require a user to be logged in or have any special permissions to initiate the attack. Interactions that do not utilize the SOAP protocol or those restricted by external network barriers are not subject to this specific trigger path.

Is my system at risk of CVE-2026-60379?

According to Halo Surface Signal, this vulnerability is very likely to impact systems because the affected platform component is inherently designed to receive external network traffic. If your deployment of the Service Delivery Platform is reachable over the network to process SOAP messages, it faces a higher probability of exposure than internal, isolated services.

What should I do if I run this Oracle software?

First, locate all instances of the Service Delivery Platform version 12.2.1.4.0 or 14.1.2.0.0 in your environment. Once identified, evaluate how these instances are connected to the network and determine their importance to your business operations. Assign clear ownership for these assets to ensure that official security updates from Oracle are applied promptly to mitigate the risk of a platform takeover.

References

www.oracle.com/security-alerts/cpujul2026.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.