PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-60866 Oracle Corporation CVE debrief

The CVE-2026-60866 vulnerability is an easily exploitable issue in the Service Delivery Platform product of Oracle Fusion Middleware, specifically in the Messaging Enabler component. It affects version 14.1.2.0.0 and allows unauthenticated attackers with network access via HTTP to compromise the Service Delivery Platform. Successful attacks can result in unauthorized update, insert or delete access to some of Service Delivery Platform accessible data as well as unauthorized read access to a subset of Service Delivery Platform accessible data. The CVSS 3.1 Base Score is 6.5, indicating a medium severity vulnerability with Confidentiality and Integrity impacts. Security teams responsible for Oracle Fusion Middleware and Service Delivery Platform should prioritize patching this vulnerability. IT administrators managing network access and HTTP services should also be aware of the potential risks and implement compensating controls. Review and apply Oracle's security patches for Service Delivery Platform 14.1.2.0.0. Implement compensating controls such as network segmentation and access restrictions. Monitor for suspicious activity and implement logging and auditing. Verify the inventory of Service Delivery Platform instances and ensure they are up-to-date. Restrict network access to the Service Delivery Platform where possible.

Vendor
Oracle Corporation
Product
Service Delivery Platform
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-18
Original CVE updated
2026-08-21
Advisory published
2026-08-18
Advisory updated
2026-08-21

Who should care

Security teams responsible for Oracle Fusion Middleware and Service Delivery Platform should prioritize patching this vulnerability. IT administrators managing network access and HTTP services should also be aware of the potential risks and implement compensating controls.

Technical summary

The CVE-2026-60866 vulnerability is an easily exploitable issue in the Service Delivery Platform product of Oracle Fusion Middleware, specifically in the Messaging Enabler component. It affects version 14.1.2.0.0 and allows unauthenticated attackers with network access via HTTP to compromise the Service Delivery Platform. Successful attacks can result in unauthorized update, insert or delete access to some of Service Delivery Platform accessible data as well as unauthorized read access to a subset of Service Delivery Platform accessible data. The CVSS 3.1 Base Score is 6.5, indicating a medium severity vulnerability with Confidentiality and Integrity impacts.

Defensive priority

Medium priority given the CVSS score of 6.5 and the potential for unauthorized data access and modifications.

Recommended defensive actions

  • Review and apply Oracle's security patches for Service Delivery Platform 14.1.2.0.0.
  • Implement compensating controls such as network segmentation and access restrictions.
  • Monitor for suspicious activity and implement logging and auditing.
  • Verify the inventory of Service Delivery Platform instances and ensure they are up-to-date.
  • Restrict network access to the Service Delivery Platform where possible.

Evidence notes

The CVE-2026-60866 vulnerability affects Oracle Fusion Middleware's Service Delivery Platform product, specifically the Messaging Enabler component in version 14.1.2.0.0. The vulnerability allows unauthenticated attackers with network access via HTTP to compromise the Service Delivery Platform, potentially leading to unauthorized updates, inserts, or deletes of accessible data, as well as unauthorized read access to a subset of accessible data. The CVSS 3.1 Base Score is 6.5, indicating a medium severity with Confidentiality and Integrity impacts.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-60866 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-60866

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-60866 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-60866

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.