CVE-2026-60861 is a CVSS 9.6 vulnerability in the Service Delivery Platform component of Oracle Fusion Middleware that lets a low-privileged network attacker read and modify all accessible data; and, per Oracle's own scoring, potentially reach beyond the product itself.
What Is It
The flaw sits in the Messaging Enabler component of Oracle Service Delivery Platform, part of Oracle Fusion Middleware. Oracle describes it as easily exploitable: an attacker with low privileges and network access over Oracle Net can compromise the platform without any user interaction.
Successful exploitation grants unauthorized creation, deletion, or modification of critical data, or all data accessible to Service Delivery Platform, as well as unauthorized read access up to complete access to that data. Availability is not impacted.
Why It Matters
The CVSS 3.1 base score is 9.6 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. The scope-changed flag is the important part: Oracle states that while the vulnerability lives in Service Delivery Platform, attacks may significantly impact additional products. A scope-changed rating means a foothold with minimal privileges is not guaranteed to stay contained to the vulnerable component; whether it actually extends further in a given environment depends on how the platform is integrated and what it is trusted to reach. Oracle has not published the specific cross-product impact paths, so the blast radius should be assessed per deployment rather than assumed from the score alone.
The combination of network attack vector, low attack complexity, low privileges required, and no user interaction (exploitability subscore 3.1) means the barrier to exploitation is low for anyone who already holds a minimal account on a reachable instance.
CVE-2026-60861 does not appear in CISA's Known Exploited Vulnerabilities catalog, and there is no evidence of active exploitation in the supplied source material. The KEV catalog is updated continuously, so this should be re-checked rather than treated as a standing conclusion.
What's Vulnerable
- Oracle Corporation; Service Delivery Platform (Oracle Fusion Middleware), component: Messaging Enabler
- Affected supported versions: 14.1.2.0.0 and 12.2.1.4.0
Patch Status
The CVE was published 2026-08-18 with NVD status "Received," meaning NVD analysis is not yet complete.
Identifying the correct patch requires care here. Oracle ships Critical Patch Updates on a fixed quarterly cycle, January, April, July, and October, so there is no August 2026 CPU. A CVE published on 2026-08-18 was therefore either fixed in the July 2026 CPU or is slated for the October 2026 CPU. The Oracle advisory link supplied with this CVE (cspuaug2026.html) does not match Oracle's advisory URL convention, which is cpu<mmm><yyyy>.html, for example, https://www.oracle.com/security-alerts/cpujul2026.html. Treat the supplied link as unverified.
Operators running 14.1.2.0.0 or 12.2.1.4.0 should check the July 2026 CPU advisory for CVE-2026-60861 first, and if it is not listed there, monitor Oracle's Critical Patch Update landing page for the October 2026 release. Oracle Support (My Oracle Support) is the authoritative place to confirm which patch set carries the fix for a given version. No further remediation guidance or required-action deadline is present in the source data.
Sources
- NVD, CVE-2026-60861: https://nvd.nist.gov/vuln/detail/CVE-2026-60861
- CISA Known Exploited Vulnerabilities Catalog (searchable; no entry for CVE-2026-60861 as of 2026-08-18): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- Oracle Critical Patch Update advisory, as supplied with the CVE record (URL does not follow Oracle's advisory naming convention and may not resolve): https://www.oracle.com/security-alerts/cspuaug2026.html
- Oracle Critical Patch Update advisories (canonical index): https://www.oracle.com/security-alerts/