CVE-2026-60389 Oracle Corporation CVE debrief

Who should care

Organizations using Oracle Fusion Middleware Service Delivery Platform versions 12.2.1.4.0 and 14.1.2.0.0 should prioritize patching this vulnerability. Security teams and administrators responsible for Oracle Fusion Middleware deployments should review and apply the necessary security patches. They should also monitor for suspicious activity, verify and update inventory of affected products, and implement compensating controls for additional product scope. Vulnerability management and security teams should track exceptions and retest remediated assets to ensure the vulnerability is properly addressed. IT operators and platform administrators should be aware of the potential operational impact and plan accordingly. Those responsible for change management and incident response should be prepared to address potential exploitation and have a plan in place for rapid response and mitigation if needed. Network security teams should restrict network access to the Service Delivery Platform and review network logs for signs of exploitation attempts. Asset inventory managers should verify that affected products are properly identified and prioritized for remediation. Those responsible for security monitoring and incident response should be prepared to detect and respond to potential exploitation attempts. Compliance and risk management teams should be aware of the potential risks and ensure that appropriate measures are taken to mitigate them. Business continuity and disaster recovery teams should consider the potential impact on business operations and have a plan in place to maintain business continuity in the event of an exploit. Communications teams should be prepared to inform stakeholders about the vulnerability and any necessary actions. Legal and regulatory compliance teams should ensure that all necessary steps are taken to comply with relevant laws and regulations. The CISO and other senior security leaders should be aware of the vulnerability and ensure that appropriate resources are allocated to address it. The incident response team should be prepared to respond quickly and effectively in the event of an exploit. The security architecture team should review

Technical summary

CVE-2026-60389 is a critical vulnerability in Oracle Fusion Middleware's Service Delivery Platform, specifically affecting versions 12.2.1.4.0 and 14.1.2.0.0. It allows unauthenticated network attackers to compromise the platform, with high impacts on confidentiality, integrity, and availability. The CVSS 3.1 score is 10.0. Successful attacks can result in takeover of Service Delivery Platform, and attacks may significantly impact additional products.

Defensive priority

Oracle Fusion Middleware Service Delivery Platform vulnerability allows unauthenticated network attackers to compromise the platform with high impact on confidentiality, integrity, and availability.

Recommended defensive actions

• Review and apply Oracle's security patches for Service Delivery Platform
• Restrict network access to the Service Delivery Platform
• Monitor for suspicious activity on the platform
• Verify and update inventory of affected products
• Implement compensating controls for additional product scope

Evidence notes

The CVE-2026-60389 vulnerability affects Oracle Fusion Middleware's Service Delivery Platform, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It allows unauthenticated attackers with network access via HTTP to compromise the platform, potentially impacting additional products. The CVSS 3.1 score is 10.0, indicating critical severity. Defenders should verify affected product deployments, review official advisories, and plan vendor-supported updates or mitigations. They should also monitor for suspicious activity, implement compensating controls, and track exceptions.

Official resources