CVE-2026-60385 Overview
CVE-2026-60385 is a critical vulnerability in the Oracle Service Delivery Platform, a component of Oracle Fusion Middleware. The flaw resides in the Messaging Enabler component and affects versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via the T3 or Internet Inter-ORB Protocol (IIOP) can compromise the Service Delivery Platform. Successful exploitation results in full takeover of the affected system, impacting confidentiality, integrity, and availability. Oracle disclosed the issue in the July 2026 Critical Patch Update advisory.
Critical Impact
Unauthenticated remote attackers can achieve full takeover of Oracle Service Delivery Platform instances exposing T3 or IIOP endpoints.
Affected Products
- Oracle Fusion Middleware — Service Delivery Platform 12.2.1.4.0
- Oracle Fusion Middleware — Service Delivery Platform 14.1.2.0.0
- Component: Messaging Enabler
Discovery Timeline
- 2026-07-21 - CVE-2026-60385 published to the National Vulnerability Database
- 2026-07-21 - Last updated in NVD database
- July 2026 - Oracle publishes fix in the Oracle Critical Patch Update Advisory - July 2026
Technical Details for CVE-2026-60385
Vulnerability Analysis
The vulnerability affects the Messaging Enabler component of Oracle Service Delivery Platform. Attackers reach the flaw over the network using Oracle's proprietary T3 protocol or the CORBA-based IIOP protocol. Both protocols are commonly exposed by WebLogic-based Fusion Middleware deployments to support remote Enterprise JavaBeans (EJB) and Java Message Service (JMS) traffic. Exploitation requires no authentication, no user interaction, and low attack complexity, which places the flaw among the highest-risk categories tracked for Fusion Middleware.
T3 and IIOP have a long history of hosting deserialization and remote invocation flaws in Oracle middleware. A successful attack compromises confidentiality, integrity, and availability with high impact on each, resulting in full takeover of the Service Delivery Platform process context. The Exploit Prediction Scoring System places the CVE at the 39th percentile at time of publication, but exposed T3/IIOP endpoints are frequent targets for opportunistic scanning.
Root Cause
Oracle's advisory does not publish detailed technical internals. Based on the affected component and protocols, the flaw is reachable through remote object invocation exposed by the Messaging Enabler. Historical Oracle CVEs in this class have stemmed from unsafe Java deserialization of untrusted objects handled during T3 or IIOP request processing.
Attack Vector
An attacker who can reach the T3 or IIOP listener port sends a crafted request to the Messaging Enabler. Because the vector is network-based and requires no privileges or user interaction, an internet-exposed listener is directly exploitable. Refer to the Oracle Security Alert July 2026 for authoritative details.
Detection Methods for CVE-2026-60385
Indicators of Compromise
- Unexpected inbound connections to WebLogic T3 (default 7001/7002) or IIOP listener ports from untrusted networks.
- New or unexplained Java child processes spawned by the Service Delivery Platform managed server.
- Anomalous outbound connections from the Fusion Middleware host following T3/IIOP traffic bursts.
- Modified or newly written files under Fusion Middleware domain directories without a corresponding change ticket.
Detection Strategies
- Monitor WebLogic access and audit logs for malformed T3/IIOP handshakes, oversized payloads, and repeated protocol errors.
- Deploy network-based inspection to flag serialized Java object markers (ac ed 00 05) inside T3/IIOP flows crossing trust boundaries.
- Correlate authentication-less requests to the Messaging Enabler with subsequent process, file, or account changes on the host.
Monitoring Recommendations
- Alert on any external source address initiating T3 or IIOP connections to Fusion Middleware managed servers.
- Track child process creation from java processes owned by the WebLogic runtime user for shell interpreters or scripting engines.
- Baseline outbound traffic from Fusion Middleware hosts and alert on deviations following inbound middleware protocol activity.
How to Mitigate CVE-2026-60385
Immediate Actions Required
- Apply the July 2026 Oracle Critical Patch Update for Fusion Middleware to all affected Service Delivery Platform instances.
- Inventory every host running Service Delivery Platform 12.2.1.4.0 or 14.1.2.0.0 and prioritize internet-facing systems first.
- Restrict T3 and IIOP listener exposure to trusted management networks using host and network firewalls.
- Rotate credentials and secrets stored on any affected host if compromise is suspected.
Patch Information
Oracle addressed CVE-2026-60385 in the July 2026 Critical Patch Update. Administrators should follow the guidance in the Oracle Critical Patch Update Advisory - July 2026 to identify the correct patch bundle for their deployment and apply it during a controlled maintenance window.
Workarounds
- Use WebLogic connection filters (weblogic.security.net.ConnectionFilterImpl) to deny T3 and IIOP traffic from untrusted subnets until patching completes.
- Disable IIOP on managed servers that do not require CORBA interoperability through the WebLogic Administration Console.
- Place Fusion Middleware behind a reverse proxy or jump host so that T3/IIOP ports are not directly reachable from untrusted networks.
# WebLogic connection filter example - restrict T3/IIOP to trusted CIDR
# Set in Administration Console: Domain > Security > Filter
weblogic.security.net.ConnectionFilterImpl
10.0.0.0/8 * * allow t3 t3s iiop iiops
0.0.0.0/0 * * deny t3 t3s iiop iiops
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
