CVE-2026-60384: Oracle SDP Auth Bypass Vulnerability

CVE-2026-60384 Overview

CVE-2026-60384 is a critical vulnerability in the Oracle Service Delivery Platform component of Oracle Fusion Middleware, specifically within the Messaging Enabler. Affected supported versions are 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access to the T3 or Internet Inter-ORB Protocol (IIOP) listeners can compromise the platform without user interaction. Successful exploitation results in full takeover of the Service Delivery Platform, impacting confidentiality, integrity, and availability. Oracle disclosed this issue in its July 2026 Critical Patch Update.

Critical Impact
Unauthenticated remote attackers can take over Oracle Service Delivery Platform instances by sending crafted requests to exposed T3 or IIOP network endpoints.

Affected Products

Oracle Fusion Middleware — Service Delivery Platform 12.2.1.4.0
Oracle Fusion Middleware — Service Delivery Platform 14.1.2.0.0
Component: Messaging Enabler

Discovery Timeline

2026-07-21 - CVE-2026-60384 published to the National Vulnerability Database
2026-07-21 - Last updated in the NVD database
July 2026 - Oracle addresses the issue in the Oracle Critical Patch Update Advisory - July 2026

Technical Details for CVE-2026-60384

Vulnerability Analysis

The vulnerability resides in the Messaging Enabler component of the Oracle Service Delivery Platform, a WebLogic-based Fusion Middleware product. The flaw is reachable over the T3 and IIOP remote invocation protocols used by WebLogic Server for Remote Method Invocation (RMI). Attackers do not need credentials, and no user interaction is required. Because the exploit path traverses network-exposed listener ports, any instance with T3 or IIOP reachable from an untrusted network is at risk. Successful exploitation yields complete takeover of the Service Delivery Platform host process, granting attackers the ability to read, modify, and destroy data managed by the service.

Root Cause

Oracle has not published component-level root cause information beyond the advisory. Historically, unauthenticated T3 and IIOP takeover conditions in Oracle Fusion Middleware trace back to unsafe deserialization of Java objects received on the remote invocation channel. Oracle's July 2026 Critical Patch Update is the authoritative source for the fix. No CWE identifier has been assigned in the NVD entry at time of publication.

Attack Vector

Exploitation occurs over the network against the T3 or IIOP listeners of an affected Service Delivery Platform deployment. An attacker crafts a malicious remote invocation payload and delivers it to the exposed protocol port. Because authentication is not required and attack complexity is low, an internet-exposed listener can be compromised in a single request sequence. The EPSS score at the time of publication is 0.486% (percentile 39.019), indicating limited observed exploitation activity so far, though the pre-authentication network reachability makes this vulnerability an attractive target.

No verified public proof-of-concept code is available. Refer to the Oracle Security Alert July 2026 for vendor-supplied technical details.

Detection Methods for CVE-2026-60384

Indicators of Compromise

Unexpected inbound connections to WebLogic T3 (7001/7002) or IIOP ports from untrusted networks.
New or unusual child processes spawned by the WebLogic Java process on Service Delivery Platform hosts.
Outbound network callbacks from Service Delivery Platform servers to unknown external hosts following T3/IIOP traffic.
Modified or newly written JSP, WAR, or class files under WebLogic domain directories.

Detection Strategies

Inspect WebLogic access and server logs for anomalous T3 or IIOP handshakes lacking legitimate application context.
Alert on Java process (java, weblogic.Server) spawning shells, cmd.exe, powershell.exe, bash, or sh.
Correlate network flow data with process telemetry to identify remote invocation traffic followed by suspicious execution.
Hunt for serialized Java payload markers (for example, \\xac\\xed\\x00\\x05) on T3/IIOP ports in packet captures.

Monitoring Recommendations

Enable verbose logging on WebLogic listener channels and forward to a centralized SIEM for retention and analytics.
Baseline expected clients of T3 and IIOP endpoints and alert on any deviation.
Monitor Service Delivery Platform host file integrity across WebLogic domain, deployment, and staging directories.

How to Mitigate CVE-2026-60384

Immediate Actions Required

Apply the fixes in the Oracle Critical Patch Update Advisory - July 2026 to all 12.2.1.4.0 and 14.1.2.0.0 Service Delivery Platform installations.
Inventory all Fusion Middleware hosts and confirm whether T3 or IIOP listeners are exposed beyond trusted management networks.
Restrict inbound access to WebLogic remote invocation ports to a defined set of administrative sources at the firewall layer.
Review WebLogic server logs and endpoint telemetry for signs of prior exploitation before returning systems to production.

Patch Information

Oracle addressed CVE-2026-60384 in the July 2026 Critical Patch Update. Administrators must apply the patch bundle that matches their Fusion Middleware version. Consult the Oracle Security Alert July 2026 for the exact patch identifiers and installation prerequisites.

Workarounds

Disable the T3 and IIOP protocols on WebLogic listen ports where they are not required by application traffic.
Configure a WebLogic connection filter (weblogic.security.net.ConnectionFilterImpl) to allow T3 and IIOP only from known administrative hosts.
Place Service Delivery Platform instances behind a reverse proxy or network segment that blocks direct external access to remote invocation ports.
Enforce mutual TLS or IPsec on management network paths that must carry T3 or IIOP traffic.

bash

# Example WebLogic connection filter rules restricting T3/IIOP to a management subnet
# Set via WebLogic Admin Console: Security > Filter > Connection Filter Rules
10.0.10.0/24 * * allow t3 t3s iiop iiops
0.0.0.0/0    * * deny  t3 t3s iiop iiops