CVE-2026-60388: Oracle Service Delivery Platform Auth Bypass

CVE-2026-60388 Overview

CVE-2026-60388 is a critical vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware, specifically within the Messaging Enabler component. The flaw allows an unauthenticated remote attacker with network access via T3 or IIOP protocols to fully compromise the Service Delivery Platform. Successful exploitation results in complete takeover of the affected system, impacting confidentiality, integrity, and availability. Oracle disclosed the issue as part of the July 2026 Critical Patch Update. Affected versions include Oracle Service Delivery Platform 12.2.1.4.0 and 14.1.2.0.0.

Critical Impact
Unauthenticated remote attackers can achieve full takeover of Oracle Service Delivery Platform through exposed T3 or IIOP network interfaces.

Affected Products

Oracle Fusion Middleware - Service Delivery Platform 12.2.1.4.0
Oracle Fusion Middleware - Service Delivery Platform 14.1.2.0.0
Component: Messaging Enabler

Discovery Timeline

2026-07-21 - CVE-2026-60388 published to the National Vulnerability Database
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60388

Vulnerability Analysis

The vulnerability resides in the Messaging Enabler component of Oracle Service Delivery Platform. It is reachable over the network through the T3 and Internet Inter-ORB Protocol (IIOP) interfaces used by Oracle WebLogic-based Fusion Middleware components. Because no authentication is required and attack complexity is low, an attacker only needs network reachability to a listening T3 or IIOP port to attempt exploitation.

Oracle classifies the outcome as full takeover of the Service Delivery Platform, meaning attackers can read sensitive data, modify application state, and disrupt service availability. Historically, T3 and IIOP flaws in Oracle Fusion Middleware have involved unsafe deserialization of remote objects, which allows attacker-controlled Java classes to execute during unmarshalling. Oracle has not published detailed root cause information beyond the July 2026 advisory.

Root Cause

Oracle's advisory identifies the Messaging Enabler subcomponent as the vulnerable surface. Flaws in Fusion Middleware messaging components typically stem from improper validation of serialized objects received over T3 or IIOP, enabling attackers to trigger untrusted code paths on the server. Refer to the Oracle Security Alert - July 2026 for authoritative technical details.

Attack Vector

The attack originates from the network. An attacker sends crafted T3 or IIOP protocol messages to the Service Delivery Platform listener. No user interaction and no prior credentials are required. Systems exposing WebLogic administrative or messaging ports to untrusted networks are directly reachable, and internal attackers with lateral network access can target the ports even when the platform is not internet-facing.

No verified public proof-of-concept code is available at this time. Describing exploitation in prose rather than sample code aligns with the current lack of published technical detail.

Detection Methods for CVE-2026-60388

Indicators of Compromise

Unexpected inbound TCP connections to WebLogic T3 default port 7001 or IIOP ports from untrusted sources.
New or modified Java processes spawned by the WebLogic managed server without a corresponding administrator action.
Anomalous outbound network traffic from the Service Delivery Platform host, including connections to unknown external hosts.
Unexplained creation of files in WebLogic domain directories or temporary paths used by the Messaging Enabler component.

Detection Strategies

Inspect WebLogic access and server logs for malformed T3 or IIOP handshake attempts and deserialization errors.
Deploy network intrusion detection signatures that flag T3 and IIOP traffic containing serialized Java class markers from untrusted sources.
Correlate authentication-free protocol traffic with subsequent process execution or filesystem changes on middleware hosts.

Monitoring Recommendations

Continuously monitor exposure of T3 and IIOP ports using external and internal attack surface scans.
Alert on WebLogic managed servers spawning shells, scripting engines, or network utilities such as curl, wget, or bash.
Track integrity of Fusion Middleware binaries and deployment descriptors to identify unauthorized modifications.

How to Mitigate CVE-2026-60388

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all affected Fusion Middleware deployments without delay.
Restrict network access to T3 and IIOP ports so only trusted management hosts can reach the Service Delivery Platform.
Inventory all instances of Service Delivery Platform 12.2.1.4.0 and 14.1.2.0.0 and confirm patch status.
Review logs for indicators of prior exploitation before returning systems to normal operation.

Patch Information

Oracle addressed the vulnerability in the July 2026 Critical Patch Update. Administrators must apply the specific patches referenced in the Oracle Security Alert - July 2026 for their exact product version. No supported workaround replaces installing the vendor patch.

Workarounds

Use the WebLogic connection filter to block T3 and T3s traffic from untrusted network ranges until patching is complete.
Disable IIOP on managed servers where the protocol is not required by application logic.
Place Fusion Middleware listeners behind a firewall or reverse proxy that enforces source IP allowlisting.

bash

# Example WebLogic connection filter rule to block T3 from untrusted networks
# Set in the WebLogic Admin Console under Domain > Security > Filter
weblogic.security.net.ConnectionFilterImpl
0.0.0.0/0 * * deny t3 t3s iiop iiops
10.0.0.0/8 * * allow t3 t3s iiop iiops