CVE-2026-60375 Overview
CVE-2026-60375 is a critical vulnerability in the Oracle Service Delivery Platform, a component of Oracle Fusion Middleware. The flaw resides in the Messaging Enabler component and affects supported versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via the T3 or IIOP protocols can compromise the Service Delivery Platform. Successful exploitation results in a full takeover of the affected instance, impacting confidentiality, integrity, and availability. Oracle disclosed the issue in the July 2026 Critical Patch Update.
Critical Impact
Unauthenticated remote attackers can achieve complete takeover of the Service Delivery Platform over T3 or IIOP with low attack complexity.
Affected Products
- Oracle Service Delivery Platform 12.2.1.4.0
- Oracle Service Delivery Platform 14.1.2.0.0
- Oracle Fusion Middleware (Messaging Enabler component)
Discovery Timeline
- 2026-07-21 - CVE-2026-60375 published to NVD
- 2026-07-21 - Last updated in NVD database
- July 2026 - Addressed in Oracle Security Alert July 2026
Technical Details for CVE-2026-60375
Vulnerability Analysis
The vulnerability affects the Messaging Enabler component of the Oracle Service Delivery Platform. Attackers reach the vulnerable code path through the T3 and IIOP remoting protocols exposed by the underlying WebLogic Server. Both protocols historically carry serialized Java objects between clients and servers.
Exploitation does not require credentials or user interaction. A remote attacker with network reachability to the T3 or IIOP listener can trigger the flaw across the network. Successful attacks yield high impact to confidentiality, integrity, and availability, consistent with remote code execution and platform takeover.
Oracle categorizes the issue as easily exploitable in the July 2026 Critical Patch Update. The EPSS score is 0.486% (percentile 39.018) as of 2026-07-23, reflecting current probabilistic exploitation forecasts rather than confirmed in-the-wild activity.
Root Cause
Oracle's advisory does not publish a CWE for this issue. Historically, T3 and IIOP flaws in Oracle Fusion Middleware stem from insecure deserialization of untrusted Java objects, where crafted gadget chains executed during object reconstruction lead to code execution. Consult the vendor advisory for the authoritative root cause.
Attack Vector
The attack vector is network-based. An attacker sends crafted T3 or IIOP protocol messages to the exposed listener port of the Service Delivery Platform instance. No authentication is required, and the interaction is scoped to a single service. Because T3 and IIOP are enabled by default on WebLogic-based deployments, exposed management interfaces amplify the attack surface.
No public proof-of-concept code or exploit is available in the referenced sources. Refer to the Oracle Security Alert July 2026 for authoritative technical guidance.
Detection Methods for CVE-2026-60375
Indicators of Compromise
- Unexpected inbound connections to T3 listener ports (typically 7001/7002) or IIOP endpoints from untrusted sources.
- Anomalous child processes spawned by the WebLogic Java process hosting the Service Delivery Platform.
- New or modified .jsp, .war, or class files under the WebLogic domain and deployment directories.
- Outbound network connections from the Service Delivery Platform host to unknown external hosts after receiving T3/IIOP traffic.
Detection Strategies
- Inspect WebLogic access and server logs for malformed T3/IIOP handshakes or serialization errors preceding process anomalies.
- Alert on Java processes executing shell interpreters (cmd.exe, /bin/sh, /bin/bash) or scripting utilities on Service Delivery Platform hosts.
- Correlate network telemetry with process telemetry to flag T3/IIOP traffic followed by suspicious host-level activity.
Monitoring Recommendations
- Enable and forward WebLogic server, access, and audit logs to a centralized analytics platform for long-term retention.
- Monitor outbound traffic from Fusion Middleware hosts and baseline expected destinations to surface command-and-control activity.
- Track integrity of WebLogic deployment and configuration directories using file integrity monitoring.
How to Mitigate CVE-2026-60375
Immediate Actions Required
- Apply the fixes contained in the July 2026 Oracle Critical Patch Update to Service Delivery Platform 12.2.1.4.0 and 14.1.2.0.0.
- Restrict network access to T3 and IIOP listener ports so that only trusted management hosts can reach them.
- Audit exposed Fusion Middleware endpoints on the perimeter and remove any unnecessary internet exposure.
Patch Information
Oracle addressed CVE-2026-60375 in the Oracle Security Alert July 2026. Administrators should identify affected Service Delivery Platform installations and apply the corresponding patch level from the Critical Patch Update advisory. Follow Oracle's documented pre- and post-patch validation steps to confirm remediation.
Workarounds
- Disable the T3 and IIOP protocols on WebLogic instances where they are not required for application functionality.
- Configure WebLogic connection filters (weblogic.security.net.ConnectionFilterImpl) to allow T3 and IIOP only from explicitly trusted CIDR ranges.
- Place the Service Delivery Platform behind a segmented management network protected by strict firewall rules.
# Example WebLogic connection filter rules to restrict T3/IIOP access
# Configure via the WebLogic Admin Console: Security > Filter
10.0.0.0/8 * 7001 allow t3 t3s iiop iiops
192.168.10.0/24 * 7001 allow t3 t3s iiop iiops
0.0.0.0/0 * 7001 deny t3 t3s iiop iiops
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
