CVE-2026-60386: Oracle SDP Auth Bypass Vulnerability

CVE-2026-60386 Overview

CVE-2026-60386 is a critical vulnerability in the Oracle Service Delivery Platform, part of Oracle Fusion Middleware. The flaw resides in the Messaging Enabler component and affects supported versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated remote attacker can exploit the issue over HTTP with low complexity and no user interaction. Successful exploitation results in complete takeover of the Service Delivery Platform, impacting confidentiality, integrity, and availability. Oracle published details in the July 2026 Critical Patch Update advisory.

Critical Impact
Unauthenticated network attackers can fully compromise the Service Delivery Platform through the Messaging Enabler component, achieving complete takeover of confidentiality, integrity, and availability.

Affected Products

Oracle Service Delivery Platform 12.2.1.4.0
Oracle Service Delivery Platform 14.1.2.0.0
Oracle Fusion Middleware Messaging Enabler component

Discovery Timeline

2026-07-21 - CVE-2026-60386 published to the National Vulnerability Database (NVD)
2026-07-21 - Last updated in NVD database
July 2026 - Oracle addresses the issue in the July 2026 Critical Patch Update (Oracle Security Alert)

Technical Details for CVE-2026-60386

Vulnerability Analysis

The vulnerability affects the Messaging Enabler component of Oracle Service Delivery Platform. The Messaging Enabler exposes HTTP-facing services that process messaging requests for downstream service delivery workflows. An unauthenticated attacker can reach these services over the network and issue crafted HTTP requests that lead to full compromise of the platform.

Oracle characterizes the flaw as easily exploitable, requiring no privileges and no user interaction. Successful exploitation yields high confidentiality, integrity, and availability impact on the Service Delivery Platform, aligning with a takeover scenario. The Exploit Prediction Scoring System (EPSS) reports a probability of 0.486% at the 39th percentile as of 2026-07-23.

Root Cause

Oracle has not published the underlying CWE classification or root-cause internals for CVE-2026-60386. Based on the impact profile documented in the July 2026 Critical Patch Update, the defect permits unauthenticated network requests reaching the Messaging Enabler to bypass access controls and drive server-side actions that culminate in platform takeover. Refer to the Oracle Security Alert for the vendor's authoritative technical description.

Attack Vector

The attack vector is network-based over HTTP. An attacker requires no valid account, no elevated privileges, and no interaction from a legitimate user. The attacker only needs network reachability to the HTTP endpoints exposed by the Messaging Enabler. Environments that expose Service Delivery Platform interfaces to the internet or to broad internal network segments face the highest risk.

No public proof-of-concept, exploit code, or CISA Known Exploited Vulnerabilities (KEV) listing exists at publication time. Detailed exploitation code is not published in this article because no verified proof-of-concept is available from Oracle or third-party sources.

Detection Methods for CVE-2026-60386

Indicators of Compromise

Unexpected HTTP requests reaching Messaging Enabler endpoints from untrusted or unusual source IP ranges.
New administrative accounts, roles, or configuration changes in the Service Delivery Platform without a corresponding change ticket.
Anomalous outbound connections initiated by Service Delivery Platform hosts to external destinations.
Creation of new processes, scheduled tasks, or scripts on Service Delivery Platform servers outside routine patch or deployment windows.

Detection Strategies

Baseline expected HTTP traffic patterns to the Messaging Enabler and alert on volume spikes or requests to rarely used paths.
Correlate authentication, configuration, and process telemetry across Service Delivery Platform hosts to identify post-exploitation activity.
Inspect web server and application logs for malformed or oversized HTTP requests targeting messaging endpoints.

Monitoring Recommendations

Forward Oracle Fusion Middleware, WebLogic, and OS-level logs to a centralized logging or SIEM platform for retention and correlation.
Monitor file integrity on Service Delivery Platform deployment directories to catch unauthorized artifact changes.
Track egress connections from Service Delivery Platform hosts and alert on connections to previously unseen destinations.

How to Mitigate CVE-2026-60386

Immediate Actions Required

Apply the fixes bundled in the Oracle July 2026 Critical Patch Update to every Service Delivery Platform instance running 12.2.1.4.0 or 14.1.2.0.0.
Inventory all Oracle Fusion Middleware deployments and identify systems exposing the Messaging Enabler to untrusted networks.
Restrict network access to Service Delivery Platform HTTP endpoints using firewall rules, reverse proxies, or network segmentation until patching completes.
Review authentication, audit, and configuration logs for signs of prior exploitation before returning systems to normal operation.

Patch Information

Oracle addresses CVE-2026-60386 in the July 2026 Critical Patch Update. Administrators should download and apply the vendor-provided patches for Service Delivery Platform 12.2.1.4.0 and 14.1.2.0.0 as documented in the Oracle Security Alert. No supported alternative to the vendor patch is available for a full remediation.

Workarounds

Block or restrict HTTP access to the Messaging Enabler component at the perimeter and internal firewalls until the patch is deployed.
Place Service Delivery Platform behind an authenticating reverse proxy or web application firewall that enforces IP allow-listing.
Disable non-essential exposed interfaces on Service Delivery Platform hosts to reduce the attack surface.

bash

# Configuration example: restrict inbound HTTP access to Service Delivery Platform
# Replace <trusted_cidr> and <sdp_port> with your environment values
iptables -A INPUT -p tcp --dport <sdp_port> -s <trusted_cidr> -j ACCEPT
iptables -A INPUT -p tcp --dport <sdp_port> -j DROP