CVE-2026-60377 Oracle Corporation CVE debrief

Who should care

Organizations using Oracle Fusion Middleware's Service Delivery Platform, specifically versions 12.2.1.4.0 and 14.1.2.0.0, should review and apply Oracle's security patches and implement compensating controls to limit potential scope change.

Technical summary

The CVE-2026-60377 vulnerability affects Oracle Fusion Middleware's Service Delivery Platform, specifically versions 12.2.1.4.0 and 14.1.2.0.0. The vulnerability allows a low-privileged attacker with network access via T3, IIOP to compromise Service Delivery Platform. Successful attacks can result in unauthorized creation, deletion or modification access to critical data or all Service Delivery Platform accessible data as well as unauthorized access to critical data or complete access to all Service Delivery Platform accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Service Delivery Platform. The CVSS 3.1 Base Score is 9.9 (Confidentiality, Integrity and Availability impacts).

Defensive priority

Oracle Service Delivery Platform vulnerability allows low-privileged attackers to compromise the platform with potential scope change impacting additional products.

Recommended defensive actions

• Review and apply Oracle's security patches for Service Delivery Platform
• Restrict network access to Service Delivery Platform
• Monitor Service Delivery Platform for suspicious activity
• Implement compensating controls to limit potential scope change
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE-2026-60377 vulnerability affects Oracle Fusion Middleware's Service Delivery Platform, specifically versions 12.2.1.4.0 and 14.1.2.0.0. The vulnerability allows a low-privileged attacker with network access via T3, IIOP to compromise Service Delivery Platform. Successful attacks can result in unauthorized creation, deletion or modification access to critical data or all Service Delivery Platform accessible data as well as unauthorized access to critical data or complete access to all Service Delivery Platform accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Service Delivery Platform.

Official resources