CVE-2026-60376: Oracle SDP Auth Bypass Vulnerability

CVE-2026-60376 Overview

CVE-2026-60376 is a critical vulnerability in the Oracle Service Delivery Platform, a component of Oracle Fusion Middleware. The flaw resides in the Messaging Enabler subcomponent and affects supported versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated remote attacker with network access via the T3 or Internet Inter-ORB Protocol (IIOP) can compromise the Service Delivery Platform. Successful exploitation results in full takeover of the platform, impacting confidentiality, integrity, and availability. Oracle addressed the issue in the July 2026 Critical Patch Update.

Critical Impact
Unauthenticated attackers can achieve complete takeover of the Oracle Service Delivery Platform over the network with low complexity and no user interaction.

Affected Products

Oracle Service Delivery Platform 12.2.1.4.0
Oracle Service Delivery Platform 14.1.2.0.0
Oracle Fusion Middleware — Messaging Enabler component

Discovery Timeline

2026-07-21 - CVE CVE-2026-60376 published to the National Vulnerability Database
2026-07-21 - Last updated in NVD database
July 2026 - Oracle releases fix in the Oracle CPU July 2026 Advisory

Technical Details for CVE-2026-60376

Vulnerability Analysis

The vulnerability affects the Messaging Enabler subcomponent of Oracle Service Delivery Platform, which is built on Oracle WebLogic Server infrastructure. Attackers reach the vulnerable code path through the T3 and IIOP protocols, both of which handle Java remote method invocation (RMI) traffic. These protocols historically expose deserialization surfaces when they process untrusted object streams from remote clients. An attacker who can send crafted T3 or IIOP requests to a listening WebLogic instance can trigger the flaw without credentials or user interaction. Successful exploitation compromises confidentiality, integrity, and availability of the Service Delivery Platform, giving the attacker full control over affected servers and any downstream messaging workflows they orchestrate.

Root Cause

Oracle has not published detailed root-cause analysis for CVE-2026-60376. Based on the attack characteristics — unauthenticated network access via T3 and IIOP against a Fusion Middleware messaging component — the flaw follows the pattern of unsafe processing of remote invocation payloads in the Messaging Enabler. Refer to the Oracle CPU July 2026 Advisory for the authoritative technical description.

Attack Vector

The attack vector is network-based. An attacker sends malicious traffic to the T3 or IIOP listener exposed by the Service Delivery Platform. No authentication, no privileges, and no user interaction are required. Any Service Delivery Platform instance whose T3/IIOP ports are reachable from an attacker-controlled network segment is exposed. Systems facing the public internet or shared corporate networks without protocol filtering are at highest risk.

No verified proof-of-concept code is publicly available. See the vendor advisory for authoritative technical details.

Detection Methods for CVE-2026-60376

Indicators of Compromise

Unexpected inbound connections to WebLogic T3 (default port 7001) or IIOP listeners from untrusted sources.
New or unusual Java processes spawned by the WebLogic managed server hosting the Service Delivery Platform.
Outbound network connections initiated by the WebLogic JVM to unfamiliar external hosts.
Modifications to Service Delivery Platform deployment directories or Messaging Enabler configuration files outside change windows.

Detection Strategies

Inspect WebLogic access logs and AdminServer.log for anomalous T3 or IIOP protocol handshakes from external IP addresses.
Deploy network intrusion detection signatures for T3/IIOP deserialization patterns targeting Oracle Fusion Middleware.
Correlate process-creation telemetry on middleware hosts to flag child processes launched by the WebLogic JVM.

Monitoring Recommendations

Forward WebLogic, operating system, and network flow logs to a centralized analytics platform for cross-source correlation.
Alert on any new listener or socket opened by the Service Delivery Platform JVM after patching.
Track version and patch state of Fusion Middleware assets to identify unpatched instances of 12.2.1.4.0 and 14.1.2.0.0.

How to Mitigate CVE-2026-60376

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Service Delivery Platform instances running 12.2.1.4.0 or 14.1.2.0.0.
Restrict network access to T3 and IIOP listeners so only trusted management hosts can reach them.
Inventory all Fusion Middleware deployments and confirm patch status against the Oracle CPU July 2026 Advisory.
Review authentication and audit logs on affected hosts for signs of prior exploitation.

Patch Information

Oracle released fixes for CVE-2026-60376 in the July 2026 Critical Patch Update. Administrators must download and apply the patch bundle corresponding to their Fusion Middleware release train. Details, patch identifiers, and installation instructions are available in the Oracle CPU July 2026 Advisory.

Workarounds

Block T3 and IIOP protocols at perimeter firewalls and network segmentation boundaries where they are not required.
Configure WebLogic connection filters (weblogic.security.net.ConnectionFilterImpl) to allow T3/IIOP only from explicit management subnets.
Disable IIOP in the WebLogic Server console for managed servers that do not require it.
Place Service Delivery Platform instances behind a reverse proxy that terminates only sanctioned application protocols.

bash

# Example WebLogic connection filter rule to restrict T3/IIOP
# Set in the WebLogic console: Domain > Security > Filter
# Allow only management subnet, deny all other T3/T3s/IIOP traffic
10.10.20.0/24 * * allow t3 t3s iiop iiops
* * * deny t3 t3s iiop iiops