CVE-2026-60379: Oracle SDP RCE Vulnerability via SOAP

CVE-2026-60379 Overview

CVE-2026-60379 is a critical vulnerability in the Oracle Service Delivery Platform, part of Oracle Fusion Middleware. The flaw resides in the Messaging Enabler component and is exploitable by an unauthenticated attacker with network access over Simple Object Access Protocol (SOAP). Successful exploitation results in complete takeover of the Service Delivery Platform. The vulnerability carries a scope change, meaning attacks can impact additional products beyond the initially compromised system. Affected versions include 12.2.1.4.0 and 14.1.2.0.0.

Critical Impact
Unauthenticated remote attackers can achieve full takeover of the Service Delivery Platform via SOAP requests, with cascading impact on connected products due to scope change.

Affected Products

Oracle Service Delivery Platform 12.2.1.4.0
Oracle Service Delivery Platform 14.1.2.0.0
Oracle Fusion Middleware (Messaging Enabler component)

Discovery Timeline

2026-07-21 - CVE-2026-60379 published to the National Vulnerability Database (NVD)
2026-07-21 - Last updated in NVD database
July 2026 - Addressed in the Oracle Security Alert July 2026

Technical Details for CVE-2026-60379

Vulnerability Analysis

The vulnerability is a Web Service (SOAP) vulnerability in the Messaging Enabler component of the Oracle Service Delivery Platform. Attackers reach the flaw over the network without authentication and without user interaction. Exploitation is described by the vendor as easy, indicating minimal attacker prerequisites. Successful attacks compromise the confidentiality, integrity, and availability of the target system.

The vulnerability also introduces a scope change. A compromise of the Service Delivery Platform can pivot into and affect additional downstream products that trust or interact with the platform. This magnifies blast radius across the Oracle Fusion Middleware environment.

Root Cause

Oracle has not published detailed technical root cause information. Based on the advisory, the flaw resides in how the Messaging Enabler processes inbound SOAP requests within the Service Delivery Platform. Refer to the Oracle Security Alert July 2026 for vendor-provided details.

Attack Vector

The attack vector is network-based via SOAP. An unauthenticated attacker with reachability to the Service Delivery Platform SOAP endpoint sends a crafted request to the Messaging Enabler. No credentials, prior access, or user interaction are required. Because the vulnerability yields full takeover with scope change, the attacker can execute privileged actions and reach components that trust the Service Delivery Platform. No public proof-of-concept exploit has been observed at the time of publication.

Detection Methods for CVE-2026-60379

Indicators of Compromise

Anomalous inbound SOAP requests to Service Delivery Platform Messaging Enabler endpoints from untrusted or external network segments.
Unexpected process spawning, new service accounts, or configuration changes on Service Delivery Platform hosts.
Outbound connections from Service Delivery Platform servers to unfamiliar IP addresses shortly after receiving SOAP traffic.
Errors or stack traces referencing the Messaging Enabler component in Oracle Fusion Middleware logs.

Detection Strategies

Inspect SOAP payloads at the application gateway or WAF for malformed structures targeting the Messaging Enabler endpoints.
Monitor Oracle Fusion Middleware audit and access logs for unauthenticated requests followed by privileged operations.
Correlate SOAP endpoint access with subsequent lateral movement toward downstream Oracle products, given the scope change nature of the flaw.

Monitoring Recommendations

Enable verbose logging on the Service Delivery Platform SOAP interfaces and forward logs to a centralized SIEM.
Baseline normal SOAP traffic volume, source addresses, and operation names, then alert on deviations.
Track version banners and patch state of 12.2.1.4.0 and 14.1.2.0.0 deployments to identify unpatched systems.

How to Mitigate CVE-2026-60379

Immediate Actions Required

Apply the fixes from the Oracle Critical Patch Update July 2026 to all affected Service Delivery Platform instances without delay.
Restrict network access to Service Delivery Platform SOAP endpoints to trusted management networks only.
Inventory all Oracle Fusion Middleware deployments running versions 12.2.1.4.0 and 14.1.2.0.0 to confirm exposure.
Review connected downstream products for signs of lateral impact given the scope change.

Patch Information

Oracle addressed this vulnerability in the July 2026 Critical Patch Update. Administrators should review the Oracle Security Alert July 2026 advisory for the applicable patch bundles and installation guidance for Oracle Fusion Middleware Service Delivery Platform.

Workarounds

Block or restrict SOAP access to the Messaging Enabler at network firewalls and reverse proxies until patches are applied.
Place the Service Delivery Platform behind an authenticated reverse proxy or API gateway that enforces schema validation on SOAP requests.
Disable or gate any unused Messaging Enabler SOAP endpoints as an interim compensating control.

bash

# Example: restrict access to Service Delivery Platform SOAP port to trusted subnet only
# Replace 10.0.0.0/24 with your trusted management subnet and 7001 with your listener port
iptables -A INPUT -p tcp --dport 7001 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7001 -j DROP