CVE-2026-60377: Oracle Service Delivery Platform Auth Bypass

CVE-2026-60377 Overview

CVE-2026-60377 is a critical vulnerability in the Oracle Service Delivery Platform, a component of Oracle Fusion Middleware. The flaw resides in the Messaging Enabler component and affects supported versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via the T3 or IIOP protocols can compromise the Service Delivery Platform. The vulnerability produces a scope change, meaning successful exploitation impacts additional products beyond the vulnerable component. Oracle disclosed the issue in the July 2026 Critical Patch Update.

Critical Impact
Attackers with low privileges can gain unauthorized create, read, update, and delete access to all Service Delivery Platform data and cause a partial denial of service across integrated products.

Affected Products

Oracle Service Delivery Platform version 12.2.1.4.0
Oracle Service Delivery Platform version 14.1.2.0.0
Oracle Fusion Middleware deployments exposing T3 or IIOP protocols

Discovery Timeline

2026-07-21 - CVE-2026-60377 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60377

Vulnerability Analysis

The vulnerability affects the Messaging Enabler component of Oracle Service Delivery Platform, which is built on the Oracle WebLogic Server foundation. The exposure occurs through the Transactional (T3) protocol and the Internet Inter-ORB Protocol (IIOP), both used for remote Java client communication. An authenticated attacker with minimal privileges can send crafted requests to these listener endpoints to trigger the flaw. Because the vulnerability produces a scope change, exploitation reaches beyond the Service Delivery Platform security boundary and affects integrated downstream products.

Successful exploitation grants attackers unauthorized read access to all data reachable by the Service Delivery Platform. Attackers can also create, modify, or delete records and cause a partial denial of service in the platform.

Root Cause

Oracle's advisory does not publish the underlying weakness class or [CWE] mapping for this issue. Vulnerabilities in the T3 and IIOP handlers of Oracle Fusion Middleware components have historically involved insecure deserialization of Java objects and inadequate access control on remote interfaces. Consult the Oracle Security Alert July 2026 for authoritative details.

Attack Vector

The attack originates from the network and requires low attack complexity. The attacker must possess low-level authenticated credentials but no user interaction is required. Exploitation targets the T3 and IIOP listener ports typically bound to the WebLogic managed server hosting the Service Delivery Platform. These ports are often reachable from internal networks and, in misconfigured deployments, from the internet.

No public proof-of-concept exploit code is available at the time of publication. See the Oracle Security Alert July 2026 for vendor guidance.

Detection Methods for CVE-2026-60377

Indicators of Compromise

Unexpected inbound connections to WebLogic T3 listener ports (default 7001, 7002) from unusual source IPs
IIOP protocol traffic to Service Delivery Platform managed servers outside baseline patterns
New or modified records in Service Delivery Platform data stores with no corresponding change-management ticket
WebLogic server logs showing anonymous or low-privileged principals executing management operations

Detection Strategies

Inspect AdminServer.log and managed server logs for deserialization exceptions and unusual weblogic.rjvm activity
Deploy network detection rules that flag T3 and IIOP traffic from non-application-tier sources
Correlate authentication events for low-privileged accounts with subsequent data modification events in the Service Delivery Platform

Monitoring Recommendations

Enable WebLogic auditing at the Advanced level and forward events to a centralized SIEM
Baseline normal T3 and IIOP client identities and alert on deviations
Monitor for outbound connections from WebLogic JVMs that could indicate post-exploitation activity

How to Mitigate CVE-2026-60377

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to Service Delivery Platform 12.2.1.4.0 and 14.1.2.0.0 installations
Restrict network access to T3 and IIOP listener ports to trusted management subnets only
Rotate credentials for any low-privileged accounts that could reach the Messaging Enabler component
Review audit logs for evidence of pre-patch exploitation attempts

Patch Information

Oracle released fixes as part of the July 2026 Critical Patch Update. Administrators should download and apply the corresponding patches from My Oracle Support. Full details are available in the Oracle Security Alert July 2026.

Workarounds

Configure the WebLogic Connection Filter (weblogic.security.net.ConnectionFilterImpl) to deny T3 and IIOP from untrusted networks
Disable IIOP on managed servers where the protocol is not required by client applications
Place Service Delivery Platform behind a reverse proxy that terminates only HTTPS and blocks direct RMI protocol access

bash

# WebLogic Connection Filter example: allow T3/IIOP only from internal management subnet
# Set in WebLogic Console: Security > Filter
10.0.0.0/8 * * allow t3 t3s iiop iiops
0.0.0.0/0  * * deny  t3 t3s iiop iiops