CVE-2026-60374: Oracle Service Delivery Platform RCE Flaw

CVE-2026-60374 Overview

CVE-2026-60374 is a critical vulnerability in the Oracle Service Delivery Platform, a component of Oracle Fusion Middleware. The flaw resides in the Messaging Enabler component and affects versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated remote attacker can exploit this issue over the network using the T3 or IIOP protocols. Successful exploitation results in complete takeover of the Service Delivery Platform, compromising confidentiality, integrity, and availability. Oracle disclosed the issue in the Oracle Security Alert July 2026.

Critical Impact
Unauthenticated attackers with network access to T3 or IIOP listeners can take full control of the Service Delivery Platform without user interaction.

Affected Products

Oracle Service Delivery Platform 12.2.1.4.0
Oracle Service Delivery Platform 14.1.2.0.0
Oracle Fusion Middleware — Messaging Enabler component

Discovery Timeline

2026-07-21 - CVE-2026-60374 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Disclosed in Oracle Critical Patch Update advisory

Technical Details for CVE-2026-60374

Vulnerability Analysis

The vulnerability affects the Messaging Enabler component of the Oracle Service Delivery Platform. Attackers reach the component through the T3 and Internet Inter-ORB Protocol (IIOP) listeners exposed by the underlying Oracle WebLogic Server. Both protocols carry Java-serialized objects between clients and the server. Exploitation requires no credentials and no user interaction, and the attack targets a single security scope.

The Service Delivery Platform provides messaging and communication services to downstream applications. A full compromise of the platform grants an attacker the same privileges as the WebLogic runtime user, exposing configuration data, message queues, credentials, and integrated backend systems.

Root Cause

Oracle has not published the low-level technical details. The affected T3 and IIOP listeners historically process untrusted Java-serialized data, and issues in this class typically map to Insecure Deserialization and Remote Code Execution weaknesses. The Messaging Enabler component appears to accept a crafted remote invocation that leads to platform takeover.

Attack Vector

The attack path is network-based against the T3 or IIOP listener ports on the affected Fusion Middleware server. An attacker sends a crafted request that abuses object handling in the Messaging Enabler to gain control of the Service Delivery Platform. No prior authentication or user interaction is required. Public exploit code is not currently available, and the EPSS probability is 0.358% at the 28th percentile.

Refer to the Oracle Security Alert July 2026 for authoritative technical guidance.

Detection Methods for CVE-2026-60374

Indicators of Compromise

Unexpected inbound connections to WebLogic T3 listener ports (default 7001, 7002) from untrusted networks.
Unusual IIOP traffic patterns or oversized serialized payloads directed at Messaging Enabler endpoints.
New or modified Java classes, WAR/EAR deployments, or scheduled tasks on the Service Delivery Platform host.
Child processes spawned by the WebLogic JVM such as shells, PowerShell, or curl/wget invocations.

Detection Strategies

Enable WebLogic access and audit logging, then correlate T3 and IIOP requests against an allowlist of trusted source addresses.
Inspect network traffic for Java serialization magic bytes (ac ed 00 05) on T3 and IIOP ports originating from unexpected clients.
Monitor the Fusion Middleware host for anomalous outbound connections that could indicate post-exploitation callbacks.

Monitoring Recommendations

Forward WebLogic server logs, host process telemetry, and network flow data to a central SIEM for correlation.
Alert on new administrator accounts, JNDI binding changes, and modifications to startup.properties or domain configuration files.
Track file integrity on WebLogic domain directories and Messaging Enabler libraries.

How to Mitigate CVE-2026-60374

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all instances of Service Delivery Platform 12.2.1.4.0 and 14.1.2.0.0.
Restrict network access to T3 and IIOP listeners so that only trusted management hosts can reach them.
Audit exposed WebLogic ports on perimeter and internal firewalls, and remove any unnecessary internet exposure.
Review Fusion Middleware logs for signs of exploitation attempts prior to patching.

Patch Information

Oracle addressed CVE-2026-60374 in the July 2026 Critical Patch Update. Administrators should follow the remediation instructions in the Oracle Security Alert July 2026 and apply the fixes to both affected versions. There is no supported configuration that removes the vulnerability without patching.

Workarounds

Use WebLogic Connection Filters to block T3 and IIOP traffic from untrusted sources until the patch can be deployed.
Disable IIOP in the WebLogic Server configuration if the protocol is not required by dependent applications.
Place the Service Delivery Platform behind a segmented management network accessible only through a jump host.

bash

# Example WebLogic connection filter rule to restrict T3/IIOP
# Set in Admin Console: Domain > Security > Filter
# weblogic.security.net.ConnectionFilterImpl
10.0.0.0/8 * * allow t3 t3s iiop iiops
0.0.0.0/0 * * deny t3 t3s iiop iiops