CVE-2026-60382: Oracle Service Delivery Platform DoS Flaw

CVE-2026-60382 Overview

CVE-2026-60382 is a denial-of-service vulnerability in the Oracle Service Delivery Platform, a component of Oracle Fusion Middleware. The flaw resides in the Messaging Enabler component and affects supported versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated remote attacker can exploit the vulnerability over HTTP to cause a hang or repeatable crash of the Service Delivery Platform. Oracle addressed the issue in the July 2026 Critical Patch Update. The vulnerability requires no user interaction and no privileges, making it accessible from any network-reachable endpoint exposing the affected service.

Critical Impact
Unauthenticated remote attackers can trigger a complete denial of service against Oracle Service Delivery Platform through low-complexity HTTP requests.

Affected Products

Oracle Fusion Middleware — Service Delivery Platform 12.2.1.4.0
Oracle Fusion Middleware — Service Delivery Platform 14.1.2.0.0
Messaging Enabler component

Discovery Timeline

2026-07-21 - CVE-2026-60382 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Oracle releases fix in the Oracle Critical Patch Update

Technical Details for CVE-2026-60382

Vulnerability Analysis

The vulnerability affects the Messaging Enabler component within the Oracle Service Delivery Platform. Attackers reach the vulnerable code path over HTTP without authentication. A successful request causes the service to hang or crash repeatedly, producing a complete availability outage. The exploitation profile is limited to availability impact — confidentiality and integrity are not affected. The EPSS score is 0.441% with a percentile of 35.9, indicating low observed exploitation activity at publication time.

Root Cause

Oracle has not published root cause details in the public advisory. The Messaging Enabler component fails to correctly handle a class of HTTP-borne input, producing a state that halts message processing or crashes the runtime. Because the attack requires no privileges and no user interaction, the parsing or dispatch logic is reachable from the network perimeter of any exposed Service Delivery Platform instance.

Attack Vector

The attack vector is network-based over HTTP. An attacker sends a crafted request to the Messaging Enabler endpoint of an exposed Service Delivery Platform instance. The request triggers resource exhaustion, an unrecoverable error, or a processing hang that renders the service unresponsive. Repeated requests reproduce the outage, preventing recovery until the service is restarted or the patch is applied. See the Oracle Critical Patch Update advisory for vendor-supplied context.

No public proof-of-concept code has been released for CVE-2026-60382 at the time of publication.

Detection Methods for CVE-2026-60382

Indicators of Compromise

Repeated crashes or restarts of the Service Delivery Platform WebLogic managed servers hosting the Messaging Enabler component.
Sudden loss of message throughput or queue processing without preceding configuration changes.
Anomalous HTTP request bursts targeting Messaging Enabler URIs from a single or small set of source addresses.

Detection Strategies

Monitor Service Delivery Platform process availability and thread state for hangs and repeated crashes.
Inspect HTTP access logs for malformed or repetitive requests to Messaging Enabler endpoints prior to service failure.
Correlate application server error logs with load balancer health-check failures to identify unexpected downtime patterns.

Monitoring Recommendations

Alert on Service Delivery Platform restart events and JVM crash dumps in production environments.
Track HTTP 5xx response rates and request latency at the Messaging Enabler ingress.
Forward WebLogic and Service Delivery Platform logs to a centralized log platform for retention and correlation.

How to Mitigate CVE-2026-60382

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update fixes for Service Delivery Platform versions 12.2.1.4.0 and 14.1.2.0.0.
Restrict network access to Messaging Enabler endpoints to trusted client networks and integration partners.
Enable rate limiting on upstream reverse proxies or load balancers protecting the Service Delivery Platform.

Patch Information

Oracle published fixes for CVE-2026-60382 in the July 2026 Critical Patch Update. Administrators should review the Oracle Critical Patch Update advisory for patch identifiers and installation procedures specific to each supported version.

Workarounds

Block untrusted networks from reaching Messaging Enabler HTTP endpoints at the firewall or web application firewall layer.
Deploy request-rate and connection-rate limits at the ingress to reduce the impact of repeated malicious requests.
Configure health-check-driven automatic restart of the Service Delivery Platform managed server to reduce mean time to recovery until patches are deployed.

bash

# Example: restrict access to Messaging Enabler endpoints at the reverse proxy
# nginx snippet - allow only trusted integration partners
location /messaging/ {
    allow 10.10.0.0/16;
    deny  all;
    limit_req zone=sdp_limit burst=20 nodelay;
    proxy_pass http://sdp_backend;
}