External risk intelligence

Oracle Fusion Middleware Service Delivery Platform Takeover Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-60380

The vulnerability affects a Service Delivery Platform, which is a middleware component often deployed in network-accessible tiers to facilitate service communication. As it is accessible via HTTP and allows unauthenticated network access, it is commonly exposed or reachable within enterprise network perimeters, making it a likely target for network-based exposure.

Missing Authentication

Oracle Service Delivery Platform

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability in Oracle Fusion Middleware's Service Delivery Platform allows an attacker to take complete control of the system over the network without needing any credentials. Its critical rating and network accessibility highlight a significant potential risk to affected systems.

Unauthenticated system takeover risk.
Critical vulnerability with broad impact.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this vulnerability by sending network requests to the Service Delivery Platform. If successful, this could lead to a complete takeover of the platform.

Network access required.
HTTP requests trigger vulnerability.
Platform takeover is the risk.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker with network access via HTTP could compromise the Service Delivery Platform. Successful exploitation could lead to a complete takeover of the platform.

Service Delivery Platform and its data.
Attacker exploits network-accessible vulnerability.
Complete takeover of the platform.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Oracle Fusion Middleware's Service Delivery Platform is a critical component, likely managed by platform or application teams. Given its network accessibility and the potential for complete takeover, the first step is to locate all instances, assess their business criticality and exposure, and identify the accountable owner to prioritize remediation efforts.

Platform and application teams own this.
Verify all Service Delivery Platform instances.
Plan remediation based on criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Oracle Fusion Middleware Service Delivery Platform?

This software is a middleware component within the Oracle Fusion Middleware suite designed to facilitate communication between services. It acts as a messaging enabler, managing the flow of data across complex enterprise architectures. Because it coordinates service interactions, it often occupies a central role in network-accessible tiers where applications exchange information.

What does CVE-2026-60380 actually mean?

This is a critical security weakness that allows an unauthorized individual to take full control of the Messaging Enabler component. It is classified as a high-impact flaw because it grants the attacker complete authority over the platform's functions, impacting the confidentiality, integrity, and availability of all data and operations handled by the system.

How is this vulnerability triggered?

An attacker triggers this bug by sending specially crafted HTTP requests to the Service Delivery Platform over the network. No prior authentication, user interaction, or valid credentials are required to initiate the attack. The vulnerability is specifically triggered by network-based HTTP communication; it is not dependent on local file execution or user-initiated actions within the application interface.

Is my system at risk of this CVE?

Halo Surface Signal indicates this is a likely target because the Service Delivery Platform is typically deployed in network-accessible tiers to support service communication. If your instance is reachable via HTTP, it is considered exposed to network-based attackers. Systems placed at the perimeter or within internal network segments that accept HTTP traffic from untrusted or broad sources require immediate attention.

When should I take action on CVE-2026-60380?

Given the potential for a complete platform takeover, prioritize identifying all instances of the Service Delivery Platform in your environment today. Work with the application owners to determine the criticality of each server, assess its current network exposure, and coordinate a plan to apply the necessary software updates from the vendor as soon as they become available.

References

www.oracle.com/security-alerts/cpujul2026.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.