Description
Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Service Delivery Platform. Successful attacks of this vulnerability can result in takeover of Service Delivery Platform. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-09-15
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Patch Now
AI Analysis

Impact

Oracle Service Delivery Platform’s Messaging Enabler component has a critical authentication bypass that allows an unauthenticated attacker with network connectivity to exploit the service over HTTP. The vulnerability can be used to fully compromise the Service Delivery Platform, resulting in complete confidentiality, integrity, and availability loss. The vulnerability is categorised as CWE-287 and CWE-306, reflecting weak authentication and insufficient privilege checks.

Affected Systems

The affected product is Oracle Service Delivery Platform (Fusion Middleware). Versions 12.2.1.4.0 and 14.1.2.0.0 are vulnerable. These versions are used through the Messaging Enabler module for inter‑system messaging.

Risk and Exploitability

The CVSS v3.1 score of 9.8 classifies the flaw as critical, though the EPSS score of less than 1% suggests low current exploit activity. The flaw is not listed in the CISA KEV catalog, indicating no confirmed widespread exploitation yet. Nonetheless, the attack vector is simple – send a crafted HTTP request to a publicly reachable Service Delivery Platform instance – and no client‑side interaction is required, making the risk high for any exposed systems.

Generated by OpenCVE AI on September 17, 2026 at 04:38 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Oracle patch or upgrade to a non‑vulnerable release of the Service Delivery Platform.
  • Restrict HTTP access to the Service Delivery Platform by implementing firewall rules or network segmentation, ensuring only trusted hosts can reach the service.
  • Enforce strong authentication and authorization mechanisms, disabling anonymous or default accounts that may expose the service.
  • Enable logging and monitoring of HTTP traffic to the Platform, alerting on suspicious patterns that could indicate exploitation attempts.

Generated by OpenCVE AI on September 17, 2026 at 04:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 17 Sep 2026 05:00:00 +0000

Type Values Removed Values Added
Title Exploitable Authentication Bypass in Oracle Service Delivery Platform's Messaging Enabler Allows Remote Code Execution

Wed, 16 Sep 2026 12:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 15 Sep 2026 23:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-287
CWE-306

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Service Delivery Platform. Successful attacks of this vulnerability can result in takeover of Service Delivery Platform. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle service Delivery Platform
CPEs cpe:2.3:a:oracle:service_delivery_platform:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:service_delivery_platform:14.1.2.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle service Delivery Platform
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Service Delivery Platform
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-15T22:54:38.310Z

Reserved: 2026-08-31T15:40:57.329Z

Link: CVE-2026-83000

cve-icon Vulnrichment

Updated: 2026-09-15T22:46:05.828Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-15T20:18:06.570

Modified: 2026-09-16T19:42:12.090

Link: CVE-2026-83000

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-17T12:00:20Z

Weaknesses
  • CWE-287

    Improper Authentication

  • CWE-306

    Missing Authentication for Critical Function