External risk intelligence

Oracle Fusion Middleware Service Delivery Platform Takeover Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-60441

The vulnerability affects a Service Delivery Platform, which is a middleware component frequently deployed as an edge service or gateway to facilitate network communication. While it uses protocols like T3 and IIOP, these are commonly exposed in middleware configurations for service integration, making the platform a likely candidate for network-reachable infrastructure in enterprise deployments.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Oracle Fusion Middleware's Service Delivery Platform, a component that facilitates communication and service delivery. The weakness, if exploited, could allow an unauthenticated attacker to gain complete control over the platform, impacting its confidentiality, integrity, and availability.

Unauthenticated attackers can fully control the platform.
Affects critical middleware, potentially impacting service delivery.
Confirming relevance and exposure is the primary leadership concern.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can compromise the Service Delivery Platform by leveraging its network-exposed Messaging Enabler component. Exploiting this vulnerability through network protocols like T3 or IIOP allows for a complete takeover of the platform.

No authentication required.
Attacker triggers via network protocols.
Full platform takeover is possible.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could impact the Service Delivery Platform, potentially allowing an attacker to gain complete control over it. This could occur when the platform is accessible over a network and exposed via T3 or IIOP protocols, leading to a full takeover of the affected system.

Service Delivery Platform may be compromised.
Unauthenticated network access could allow attack.
Complete takeover of the platform is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and infrastructure teams are likely responsible for addressing this vulnerability in Oracle Fusion Middleware's Service Delivery Platform. The first practical step is to identify all instances of the affected product, confirm their network reachability and business criticality, and then locate the accountable owner to plan remediation based on the associated risk.

Application or platform teams own remediation.
Verify network exposure and business criticality.
Plan maintenance or vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Oracle Fusion Middleware Service Delivery Platform?

It is a middleware component designed to manage and facilitate communication between diverse software services. It acts as a messaging enabler, essentially serving as a backbone that allows different parts of an enterprise application architecture to exchange information reliably. Organizations use it to streamline service delivery across complex distributed environments.

How should I understand the nature of CVE-2026-60441?

This CVE describes a critical security weakness that allows an unauthenticated attacker to gain full control over the Messaging Enabler component. It represents a total compromise of the platform's confidentiality, integrity, and availability, meaning an attacker could read sensitive data, modify system functions, or disrupt operations entirely without needing any valid user credentials.

When is the Messaging Enabler vulnerable to this attack?

The vulnerability is triggered when an attacker sends malicious requests to the platform over T3 or IIOP network protocols. It does not occur if the platform is completely isolated from the network, as the attack requires remote connectivity. Simply having the service running is not enough; the attacker must have network-level access to the specific ports or services handling T3 and IIOP traffic.

Why does Halo Surface Signal categorize this as an external risk?

Halo Surface Signal flags this as likely relevant to external exposure because the Service Delivery Platform is frequently deployed as an edge service or gateway. Since it must communicate across networks, these specific middleware components are often placed in positions where they are reachable by outside traffic, increasing the likelihood that they are exposed to the network conditions necessary for this attack.

Do I need to take action if I run these Oracle versions?

Yes, start by identifying all deployments of the affected versions, 12.2.1.4.0 and 14.1.2.0.0, in your environment. Prioritize mapping where these instances exist on your network and determining their business criticality. Once identified, coordinate with the infrastructure teams accountable for these systems to plan the necessary remediation steps or vendor-provided updates.

References

www.oracle.com/security-alerts/cpujul2026.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.