External risk intelligence

Oracle Fusion Middleware Service Delivery Platform Messaging Enabler Takeover Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-60384

The vulnerability affects the Messaging Enabler component of an Oracle Service Delivery Platform. This type of middleware is commonly deployed as a service-oriented architecture gateway or integration layer to facilitate network communication, making it a likely candidate for exposure in environments where inter-service or external messaging is required.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Oracle Fusion Middleware's Service Delivery Platform, specifically within the Messaging Enabler component. This issue is exploitable remotely by unauthenticated attackers and could lead to a complete takeover of the platform, impacting confidentiality, integrity, and availability.

Unauthenticated attackers can gain full control.
Critical platform vulnerability requires attention.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this vulnerability by sending network requests to the Service Delivery Platform's Messaging Enabler component. This component is involved in message handling, and successful exploitation allows an attacker to take complete control of the platform.

Network access required.
Messaging Enabler component is triggered.
Complete takeover of the platform.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker with network access could compromise the Oracle Service Delivery Platform when its Messaging Enabler component is exposed. This vulnerability could allow for a complete takeover of the Service Delivery Platform, potentially impacting its confidentiality, integrity, and availability.

Service Delivery Platform compromised.
Network access via T3, IIOP.
Full platform takeover possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Service Delivery Platform, specifically its Messaging Enabler component, is likely managed by the platform or infrastructure teams responsible for Oracle Fusion Middleware. The first practical step is to identify all instances of this platform, determine their network accessibility and business criticality, and locate the accountable owner for remediation planning.

Platform or infrastructure team ownership.
Verify network exposure and business criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Oracle Fusion Middleware Service Delivery Platform?

It is a foundational software layer designed to manage complex message routing and connectivity between different enterprise applications. The Messaging Enabler component specifically acts as a gateway that facilitates communication using specialized protocols like T3 and IIOP. It is typically used in service-oriented architectures to bridge disparate systems, ensuring data flows reliably across an organization's internal or external network infrastructure.

What does CVE-2026-60384 mean for system security?

This vulnerability represents a critical flaw where the system fails to verify the identity of the person or process sending messages. Because it lacks authentication, an attacker can send malicious commands directly to the Messaging Enabler. This allows the attacker to bypass normal security controls, effectively gaining the same level of command and control over the platform as an authorized administrator.

How is this vulnerability triggered by an attacker?

An attacker triggers the flaw by sending specifically crafted network requests via the T3 or IIOP protocols to the Messaging Enabler. It is important to note that the vulnerability is not triggered by standard user interactions through a web browser or simple HTTP traffic; the attacker must have the ability to communicate directly with these specific middleware messaging ports to initiate the compromise.

Is my environment at risk from this CVE?

According to Halo Surface Signal, this software is often placed at network edges to handle communications, making it a likely candidate for being internet-facing. If your instance of the Service Delivery Platform is accessible from outside your secure internal network, or if it facilitates messaging between untrusted segments, the risk is significantly higher. You should prioritize assessing any instance that maintains open T3 or IIOP connections.

What should I do if I run this software?

Begin by inventorying your environment to locate all active instances of the Service Delivery Platform, focusing specifically on those using the Messaging Enabler component. Verify the network configuration for each to see if they are reachable from outside your organization. Once identified, coordinate with your infrastructure or middleware teams to document the business criticality of these assets and prepare for official patches from the vendor.

References

www.oracle.com/security-alerts/cpujul2026.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.