PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-60860 Oracle Corporation CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-18T21:16:45.500Z and has not been modified since then. The vulnerability is in Service Delivery Platform, a component of Oracle Fusion Middleware. Supported versions that are affected are 14.1.2.0.0 and 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise Service Delivery Platform. While the vulnerability is in Service Delivery Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Service Delivery Platform accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Service Delivery Platform. Organizations should verify their deployments and apply patches or updates as recommended by the vendor. Additionally, restricting network access and monitoring for suspicious activity can help mitigate potential risks. It is also recommended to implement compensating controls and conduct regular inventory checks to ensure the security of the system.

Vendor
Oracle Corporation
Product
Service Delivery Platform
CVSS
HIGH 8.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-18
Original CVE updated
2026-08-21
Advisory published
2026-08-18
Advisory updated
2026-08-21

Who should care

Organizations using Oracle Fusion Middleware, specifically Service Delivery Platform, should prioritize patching this vulnerability due to its high CVSS score and potential impact on data integrity and availability.

Technical summary

Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). Supported versions that are affected are 14.1.2.0.0 and 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise Service Delivery Platform. While the vulnerability is in Service Delivery Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Service Delivery Platform accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Service Delivery Platform. CVSS 3.1 Base Score 8.7 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H).

Defensive priority

High priority due to potential for unauthorized creation, deletion or modification access to critical data or all Service Delivery Platform accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Service Delivery Platform.

Recommended defensive actions

  • Apply vendor patches or updates
  • Restrict network access to Service Delivery Platform
  • Monitor for suspicious activity
  • Implement compensating controls
  • Conduct inventory checks

Evidence notes

The vulnerability is in Service Delivery Platform, a component of Oracle Fusion Middleware. Supported versions that are affected are 14.1.2.0.0 and 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise Service Delivery Platform. While the vulnerability is in Service Delivery Platform, attacks may significantly impact additional products (scope change).

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-18T21:16:45.500Z and has not been modified since then.