CVE-2026-60375 Oracle Corporation CVE debrief

Who should care

Organizations using Oracle Fusion Middleware's Service Delivery Platform, specifically versions 12.2.1.4.0 and 14.1.2.0.0, should prioritize patching or mitigating this vulnerability to prevent potential takeovers. This includes operators, platform administrators, vulnerability management teams, and security teams who are responsible for ensuring the security and integrity of their systems.

Technical summary

The CVE-2026-60375 vulnerability is a critical issue in Oracle Fusion Middleware's Service Delivery Platform, specifically affecting versions 12.2.1.4.0 and 14.1.2.0.0. The vulnerability allows unauthenticated attackers with network access via T3 or IIOP to compromise the Service Delivery Platform, potentially leading to a takeover. The CVSS 3.1 Base Score is 9.8, indicating a critical vulnerability. This issue is exploitable and can result in confidentiality, integrity, and availability impacts. Affected organizations should prioritize patching or mitigating this vulnerability.

Defensive priority

Critical vulnerability in Oracle Fusion Middleware's Service Delivery Platform, allowing unauthenticated attackers to compromise the platform via T3 or IIOP.

Recommended defensive actions

• Apply vendor patches or updates to affected versions of Oracle Fusion Middleware's Service Delivery Platform
• Implement compensating controls, such as network access restrictions or monitoring for suspicious activity
• Conduct regular inventory checks to ensure affected systems are identified and remediated
• Review and verify the integrity of affected systems
• Monitor for suspicious activity or potential exploitation attempts
• Track exceptions and retest remediated assets
• Close the item only after evidence is documented

Evidence notes

The CVE-2026-60375 vulnerability affects Oracle Fusion Middleware's Service Delivery Platform, specifically versions 12.2.1.4.0 and 14.1.2.0.0. The vulnerability allows unauthenticated attackers with network access via T3 or IIOP to compromise the Service Delivery Platform, potentially leading to a takeover. The CVSS 3.1 Base Score is 9.8, indicating a critical vulnerability.

Official resources