CVE-2026-60387: Oracle Service Delivery Platform RCE Flaw

CVE-2026-60387 Overview

CVE-2026-60387 is a critical unauthenticated remote code execution vulnerability affecting the Messaging Enabler component of Oracle Service Delivery Platform, part of Oracle Fusion Middleware. An attacker with network access to the T3 or Internet Inter-ORB Protocol (IIOP) interfaces can compromise the platform without credentials or user interaction. Successful exploitation results in full takeover of the Service Delivery Platform, impacting confidentiality, integrity, and availability. Oracle addressed the vulnerability in the July 2026 Critical Patch Update. Affected versions include 12.2.1.4.0 and 14.1.2.0.0.

Critical Impact
Unauthenticated network attackers can fully compromise the Service Delivery Platform through exposed T3/IIOP endpoints, leading to complete system takeover.

Affected Products

Oracle Service Delivery Platform 12.2.1.4.0
Oracle Service Delivery Platform 14.1.2.0.0
Oracle Fusion Middleware (Messaging Enabler component)

Discovery Timeline

2026-07-21 - CVE-2026-60387 published to the National Vulnerability Database (NVD)
2026-07-21 - Last updated in NVD database
July 2026 - Oracle releases fix in the Oracle Security Advisory: CPU July 2026

Technical Details for CVE-2026-60387

Vulnerability Analysis

The flaw resides in the Messaging Enabler component of Oracle Service Delivery Platform, which exposes services over the T3 and IIOP protocols. These protocols are the primary remote invocation channels used by Oracle WebLogic Server and Fusion Middleware for Remote Method Invocation (RMI). An unauthenticated attacker with network reachability to the affected listener can send crafted protocol messages that lead to complete compromise of the target host.

The vulnerability is network-exploitable, requires no privileges, and does not depend on user interaction. Oracle's advisory categorizes the outcome as takeover of the Service Delivery Platform, indicating impact to confidentiality, integrity, and availability.

Root Cause

Oracle has not disclosed the underlying flaw class. Historically, unauthenticated T3/IIOP takeover vulnerabilities in Oracle Fusion Middleware have stemmed from insecure Java deserialization in RMI message handlers, where attacker-controlled serialized objects trigger gadget chains during unmarshalling. Refer to the vendor advisory for authoritative technical details.

Attack Vector

Exploitation proceeds over the network against the T3 or IIOP listener ports exposed by the Service Delivery Platform. An attacker sends a specially crafted RMI message to the Messaging Enabler endpoint. Because authentication is not required, any host able to reach the listener port can attempt exploitation. Successful attacks yield code execution and administrative control over the platform.

No verified public proof-of-concept code is available at the time of publication. The EPSS probability is 0.358% (percentile 28.26) as of 2026-07-23.

Detection Methods for CVE-2026-60387

Indicators of Compromise

Unexpected inbound connections to T3 (default TCP 7001/7002) or IIOP listener ports from untrusted sources.
New or unexpected child processes spawned by Oracle WebLogic or Service Delivery Platform Java processes.
Outbound network connections originating from the WebLogic Java process to unfamiliar external hosts.
Modifications to Fusion Middleware domain directories, deployed applications, or scheduled task configurations.

Detection Strategies

Inspect WebLogic access and server logs for anomalous T3/IIOP requests, deserialization exceptions, or ClassNotFoundException entries in stack traces.
Alert on Java process behavior deviating from baselines, including shell spawns, credential dumping utilities, or scripting interpreter execution.
Correlate authentication-free access to Fusion Middleware endpoints with subsequent process or file system changes on the host.

Monitoring Recommendations

Continuously monitor network flows to Service Delivery Platform hosts and restrict T3/IIOP exposure to trusted management networks.
Forward WebLogic, operating system, and EDR telemetry to a centralized SIEM for correlation and retention.
Review Oracle patch inventory and configuration drift on Fusion Middleware nodes to confirm the July 2026 CPU has been applied.

How to Mitigate CVE-2026-60387

Immediate Actions Required

Apply the Oracle July 2026 Critical Patch Update to all instances of Oracle Service Delivery Platform running versions 12.2.1.4.0 and 14.1.2.0.0.
Restrict T3 and IIOP listener access at the network layer to a minimal set of trusted administrative hosts.
Audit exposed Fusion Middleware endpoints and remove Service Delivery Platform listeners from internet-facing interfaces.
Review logs and host telemetry for indicators of prior exploitation on affected servers.

Patch Information

Oracle published the fix in the Oracle Security Advisory: CPU July 2026. Administrators should follow Oracle's documented patch application procedure for Fusion Middleware, including domain backups and validation of dependent components prior to deployment.

Workarounds

Use WebLogic connection filters (weblogic.security.net.ConnectionFilterImpl) to block T3 and T3s traffic from untrusted sources until patches are applied.
Disable IIOP in the WebLogic administration console on servers that do not require it.
Enforce network segmentation and firewall rules to isolate Fusion Middleware management ports from general user networks.

bash

# Example WebLogic connection filter rule to deny T3/T3s from untrusted networks
# Configure via: Domain > Security > Filter > Connection Filter Rules
0.0.0.0/0 * * deny t3 t3s iiop iiops
10.0.0.0/8 * * allow t3 t3s