CVE-2026-60381: Oracle Service Delivery Platform RCE

CVE-2026-60381 Overview

CVE-2026-60381 is a critical vulnerability in the Oracle Service Delivery Platform, part of Oracle Fusion Middleware, within the Messaging Enabler component. Affected versions include 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via the T3 or IIOP protocols can compromise the platform with low attack complexity. Successful exploitation results in full takeover of the Service Delivery Platform and produces a scope change, meaning impact extends beyond the vulnerable component to additional Oracle products. Oracle disclosed the issue in the July 2026 Critical Patch Update.

Critical Impact
Remote, low-privileged attackers can fully compromise Oracle Service Delivery Platform through exposed T3/IIOP interfaces, with cross-product impact due to scope change.

Affected Products

Oracle Fusion Middleware — Service Delivery Platform 12.2.1.4.0
Oracle Fusion Middleware — Service Delivery Platform 14.1.2.0.0
Messaging Enabler component (T3, IIOP interfaces)

Discovery Timeline

2026-07-21 - CVE-2026-60381 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Addressed in Oracle Security Alert July 2026

Technical Details for CVE-2026-60381

Vulnerability Analysis

The vulnerability resides in the Messaging Enabler component of Oracle Service Delivery Platform. Attackers reach the flaw through the T3 and Internet Inter-ORB Protocol (IIOP) remote invocation channels, both used by WebLogic-based Fusion Middleware components for remote method calls. The advisory states the issue is easily exploitable and requires only low privileges with no user interaction. Successful exploitation compromises confidentiality, integrity, and availability of the Service Delivery Platform.

The scope change indicates the vulnerable component authorizes activity beyond its own security boundary. Attackers who compromise the Messaging Enabler can therefore pivot to additional Oracle products that trust the Service Delivery Platform. Oracle categorizes the outcome as a takeover of the platform, indicating attackers can execute privileged operations against messaging and downstream services.

Root Cause

Oracle has not publicly disclosed the specific root cause or associated CWE identifier. Historically, remote takeover flaws reachable via T3 and IIOP in Oracle Fusion Middleware stem from unsafe deserialization of Java objects transmitted over these protocols. Refer to the Oracle Security Alert July 2026 for authoritative technical details.

Attack Vector

Exploitation requires network reachability to the T3 or IIOP listener ports of an affected Service Delivery Platform instance and a low-privileged authenticated session. The attacker sends crafted remote invocation traffic to the Messaging Enabler component. No user interaction is required. Because scope changes to affected downstream products, a single compromised entry point can cascade across the Fusion Middleware environment.

No public proof-of-concept exploit is available at the time of writing. The EPSS score is 0.328% at the 25th percentile, reflecting a low current probability of observed exploitation. Oracle Fusion Middleware vulnerabilities of this severity have historically attracted exploit development, so the score should not be treated as a stable indicator.

Detection Methods for CVE-2026-60381

Indicators of Compromise

Unexpected inbound connections to WebLogic T3 (7001/tcp, 7002/tcp) or IIOP listener ports from untrusted networks.
Anomalous Java process spawning of shells, cmd.exe, powershell.exe, or curl/wget from the WebLogic or Service Delivery Platform server process.
New or modified files under Fusion Middleware domain directories, particularly deployed applications, staged libraries, or startup scripts.
Outbound connections from the middleware host to previously unseen external hosts following T3/IIOP traffic.

Detection Strategies

Inspect WebLogic access and server logs for unusual T3/IIOP invocations targeting the Messaging Enabler component.
Alert on child processes of Java middleware processes that are inconsistent with normal application behavior.
Correlate authentication events for low-privileged Fusion Middleware accounts with subsequent remote invocation activity.

Monitoring Recommendations

Baseline expected T3/IIOP client source addresses and alert on deviations.
Monitor JVM memory and class loading patterns for indicators consistent with deserialization exploitation.
Forward Fusion Middleware, host EDR, and network telemetry to a central SIEM for cross-source correlation.

How to Mitigate CVE-2026-60381

Immediate Actions Required

Apply the fixes listed in the Oracle Security Alert July 2026 to all affected Service Delivery Platform deployments.
Restrict network access to T3 and IIOP listener ports to trusted management networks only.
Rotate credentials for any low-privileged accounts that could reach the Messaging Enabler component.
Review Fusion Middleware audit logs for suspicious remote invocations prior to patching.

Patch Information

Oracle addressed CVE-2026-60381 in the July 2026 Critical Patch Update. Administrators must apply the patch set updates that map to their installed Fusion Middleware version, specifically for Service Delivery Platform 12.2.1.4.0 and 14.1.2.0.0. Consult the Oracle Security Alert July 2026 for the exact patch identifiers, prerequisites, and installation order.

Workarounds

Use WebLogic connection filters to deny T3 and IIOP traffic from untrusted networks until patching is complete.
Place Fusion Middleware administrative interfaces behind a VPN or bastion host to eliminate direct internet exposure.
Disable IIOP where not required by application dependencies to reduce the attack surface.

bash

# WebLogic connection filter example to restrict T3/IIOP to a management subnet
# Configure via WLST or the Administration Console: Security -> Filter
# Connection Filter: weblogic.security.net.ConnectionFilterImpl
# Rules (order matters):
10.0.0.0/8 * * allow t3 t3s iiop iiops
0.0.0.0/0  * * deny  t3 t3s iiop iiops