Information disclosure in Oracle Fusion Middleware
CVE-2026-60440
Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Service Delivery Platform. While the vulnerability is in Service Delivery Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Service Delivery Platform accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
Vulnerability class: Information Disclosure
EPSS: 0.004 (32.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.7 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N.
Affected products
- Oracle Fusion_middleware — versions 12.2.1.4.0, 14.1.2.0.0
- Oracle Service_delivery_platform
- Oracle Corporation Service Delivery Platform — versions 12.2.1.4.0, 14.1.2.0.0
Weakness classification (CWE)
References
- secalert_us@oracle.com (vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-60440?
- CVE-2026-60440 is a high-severity vulnerability in Oracle Fusion Middleware, classified under Information Disclosure. CVSS score: 7.7/10. Published 2026-07-21.
- How severe is CVE-2026-60440?
- High severity. CVSS v3 base score is 7.7 out of 10.