CVE-2026-60380: Oracle SDP Auth Bypass Vulnerability

CVE-2026-60380 Overview

CVE-2026-60380 is a critical unauthenticated remote code execution vulnerability in the Oracle Service Delivery Platform, part of Oracle Fusion Middleware. The flaw resides in the Messaging Enabler component and affects supported versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can compromise the platform without user interaction. Successful exploitation results in full takeover of the Service Delivery Platform, impacting confidentiality, integrity, and availability. Oracle disclosed the issue as part of its July 2026 Critical Patch Update.

Critical Impact
Unauthenticated remote attackers can achieve complete takeover of Oracle Service Delivery Platform instances exposed over HTTP.

Affected Products

Oracle Fusion Middleware — Service Delivery Platform 12.2.1.4.0
Oracle Fusion Middleware — Service Delivery Platform 14.1.2.0.0
Messaging Enabler component

Discovery Timeline

2026-07-21 - CVE CVE-2026-60380 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Addressed in the Oracle Critical Patch Update

Technical Details for CVE-2026-60380

Vulnerability Analysis

The vulnerability affects the Messaging Enabler component of the Oracle Service Delivery Platform. The attack surface is exposed over HTTP and requires no authentication, no privileges, and no user interaction. Attackers can reach the vulnerable endpoint remotely and drive it into a state that grants full control of the platform.

Because the Service Delivery Platform mediates messaging and service delivery flows for downstream applications, compromise of the host process typically exposes credentials, integration secrets, and message content passing through the enabler. The Oracle advisory classifies the outcome as "takeover," which indicates the attacker gains control equivalent to the application service account.

Root Cause

Oracle has not publicly disclosed low-level technical detail, and no CWE has been assigned in NVD at the time of publication. The advisory language, ease of exploitation, and unauthenticated network vector are consistent with input handling flaws in Fusion Middleware messaging components, such as insecure deserialization or improper authorization on HTTP-exposed endpoints. Refer to the Oracle Critical Patch Update for authoritative technical guidance.

Attack Vector

Exploitation occurs over the network via HTTP against a reachable Service Delivery Platform instance. The attacker sends crafted HTTP requests directly to the Messaging Enabler endpoint. No credentials are required, and no victim interaction is needed. Public proof-of-concept code is not available, and the vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.358% (percentile 28.26) as of 2026-07-23.

No verified exploit code is publicly available. Technical details are limited to Oracle's advisory.

Detection Methods for CVE-2026-60380

Indicators of Compromise

Unexpected outbound connections from Service Delivery Platform hosts to unknown external IP addresses following inbound HTTP requests to Messaging Enabler endpoints.
New or modified files, scheduled tasks, or child processes spawned by the WebLogic or Fusion Middleware service account hosting the Service Delivery Platform.
Anomalous HTTP POST requests with large or malformed payloads targeting Messaging Enabler URIs.

Detection Strategies

Inspect HTTP access logs on Oracle HTTP Server and WebLogic instances fronting Service Delivery Platform for unusual request patterns to Messaging Enabler paths.
Baseline normal process lineage for the middleware service account and alert on shell, scripting, or LOLBins spawned from Java processes.
Correlate WebLogic domain audit events with EDR telemetry to identify post-exploitation behavior such as credential dumping or lateral movement.

Monitoring Recommendations

Enable verbose HTTP request logging on affected middleware tiers and forward logs to a centralized analytics platform for retention and search.
Monitor for outbound network traffic from middleware hosts that deviates from documented integration flows.
Track file integrity on Fusion Middleware domain directories, deployment folders, and configuration stores.

How to Mitigate CVE-2026-60380

Immediate Actions Required

Apply the fixes delivered in the July 2026 Oracle Critical Patch Update to all affected Service Delivery Platform deployments.
Inventory 12.2.1.4.0 and 14.1.2.0.0 instances and prioritize internet-exposed systems for immediate patching.
Restrict inbound HTTP access to Messaging Enabler endpoints to trusted networks until patching is complete.
Rotate credentials, keys, and integration secrets used by the Service Delivery Platform if compromise is suspected.

Patch Information

Oracle addressed CVE-2026-60380 in the Oracle Critical Patch Update - July 2026. Administrators should apply the vendor-supplied patches for Service Delivery Platform versions 12.2.1.4.0 and 14.1.2.0.0 following Oracle's documented upgrade procedures for Fusion Middleware.

Workarounds

Place the Service Delivery Platform behind a web application firewall configured to filter requests to Messaging Enabler endpoints.
Enforce network segmentation so that only authorized upstream systems can reach the platform over HTTP.
Disable the Messaging Enabler component if it is not required by the deployment, in accordance with Oracle documentation.

bash

# Example: restrict access to the Service Delivery Platform HTTP listener using iptables
iptables -A INPUT -p tcp --dport 7001 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 7001 -j DROP