CVE-2026-60389: Oracle Service Delivery Platform RCE Flaw

CVE-2026-60389 Overview

CVE-2026-60389 is a critical vulnerability in the Oracle Service Delivery Platform, a component of Oracle Fusion Middleware. The flaw resides in the Messaging Enabler component and affects versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can exploit the vulnerability without user interaction. Successful exploitation results in complete takeover of the Service Delivery Platform. The vulnerability carries a scope change, meaning attacks can extend beyond the vulnerable component and impact additional products. Oracle addressed this issue in the July 2026 Critical Patch Update.

Critical Impact
Unauthenticated remote attackers can achieve full takeover of Oracle Service Delivery Platform over HTTP, with cascading impact to connected products.

Affected Products

Oracle Service Delivery Platform 12.2.1.4.0
Oracle Service Delivery Platform 14.1.2.0.0
Oracle Fusion Middleware (Messaging Enabler component)

Discovery Timeline

2026-07-21 - CVE CVE-2026-60389 published to the National Vulnerability Database (NVD)
2026-07-21 - Oracle disclosed the vulnerability in the July 2026 Critical Patch Update
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-60389

Vulnerability Analysis

The vulnerability affects the Messaging Enabler component of Oracle Service Delivery Platform, a middleware product used to expose telecom and enterprise services over standard protocols. An attacker sends crafted HTTP requests to the exposed Messaging Enabler interface and gains full control of the platform. The flaw is remotely exploitable over the network, requires no authentication, and requires no user interaction. Oracle characterizes the flaw as easily exploitable. The scope change indicates that a successful attack breaks the security boundary of the vulnerable component and affects downstream systems that trust the Service Delivery Platform.

Root Cause

Oracle has not published a detailed root cause analysis. The advisory indicates the defect exists within the Messaging Enabler code path that processes HTTP-delivered messages. Because the vulnerability requires no privileges and no user interaction, the underlying weakness likely involves missing authentication, unsafe input handling, or insecure deserialization within a network-facing message handler.

Attack Vector

The attack vector is network-based over HTTP. An unauthenticated attacker with reachability to the Messaging Enabler endpoint can trigger the vulnerability. No specific proof-of-concept has been released publicly, and no exploitation in the wild has been confirmed. The EPSS score is 0.486% as of 2026-07-23. Refer to the Oracle CPU July 2026 Advisory for vendor-provided technical details.

// No verified public proof-of-concept is available.
// See the Oracle CPU July 2026 Advisory for vendor guidance.

Detection Methods for CVE-2026-60389

Indicators of Compromise

Unexpected HTTP POST or PUT requests directed at Messaging Enabler endpoints from external or non-administrative source IPs.
New administrative accounts, altered service configurations, or unexplained restarts of the Service Delivery Platform.
Outbound connections from the Service Delivery Platform host to unfamiliar external addresses following anomalous HTTP traffic.

Detection Strategies

Review web server and application logs for malformed or oversized HTTP requests targeting Messaging Enabler URIs.
Correlate authentication logs and process execution events on Service Delivery Platform hosts to identify post-exploitation activity.
Deploy network signatures that flag anomalous HTTP payloads to Oracle Fusion Middleware listeners.

Monitoring Recommendations

Enable verbose audit logging on Oracle Fusion Middleware and forward events to a centralized SIEM for correlation.
Monitor for child processes spawned by the Service Delivery Platform Java runtime that are inconsistent with normal operation.
Alert on configuration file changes and new deployment artifacts on Service Delivery Platform servers.

How to Mitigate CVE-2026-60389

Immediate Actions Required

Apply the fixes from the Oracle CPU July 2026 Advisory to all affected Service Delivery Platform instances.
Inventory all Oracle Fusion Middleware deployments to identify versions 12.2.1.4.0 and 14.1.2.0.0.
Restrict network access to Messaging Enabler endpoints so that only trusted internal systems can reach them.
Review logs for signs of exploitation activity prior to patching.

Patch Information

Oracle released fixes for CVE-2026-60389 in the July 2026 Critical Patch Update. Administrators must apply the vendor patches for Oracle Service Delivery Platform versions 12.2.1.4.0 and 14.1.2.0.0. Consult the Oracle CPU July 2026 Advisory for exact patch identifiers and installation guidance.

Workarounds

Place Messaging Enabler endpoints behind a web application firewall configured to block unauthenticated HTTP requests from untrusted networks.
Segment the Service Delivery Platform onto an isolated network zone with strict ingress filtering until patches are deployed.
Disable exposed Messaging Enabler interfaces that are not required for business operations.

bash

# Example iptables rule to restrict HTTP access to trusted management subnet
iptables -A INPUT -p tcp --dport 80 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP