CVE-2026-60440: Oracle SDP Information Disclosure Flaw

CVE-2026-60440 Overview

CVE-2026-60440 is a high-severity vulnerability in the Oracle Service Delivery Platform, part of Oracle Fusion Middleware. The flaw resides in the Messaging Enabler component and affects supported versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via HTTP can exploit the issue without user interaction. Successful exploitation results in unauthorized access to critical data or complete access to all Service Delivery Platform accessible data. The vulnerability carries a scope change, meaning attacks originating in Service Delivery Platform can significantly impact additional products. Oracle disclosed the issue in the July 2026 Critical Patch Update.

Critical Impact

Authenticated network-based attackers can achieve unauthorized access to all data accessible through Oracle Service Delivery Platform, with impact extending beyond the vulnerable component due to scope change.

Affected Products

• Oracle Fusion Middleware — Service Delivery Platform 12.2.1.4.0
• Oracle Fusion Middleware — Service Delivery Platform 14.1.2.0.0
• Component: Messaging Enabler

Discovery Timeline

• 2026-07-21 - CVE-2026-60440 published to the National Vulnerability Database
• 2026-07-21 - Last updated in NVD database
• July 2026 - Addressed in the Oracle Critical Patch Update Advisory

Technical Details for CVE-2026-60440

Vulnerability Analysis

The vulnerability affects the Messaging Enabler component within Oracle Service Delivery Platform. The flaw is easily exploitable and requires only low-privilege authentication combined with network access over HTTP. No user interaction is needed to trigger the condition.

Exploitation impacts confidentiality without affecting integrity or availability. The scope change indicator means the compromised component can influence resources managed by other security authorities. This behavior is common when a middleware component brokers messaging between multiple downstream products, allowing an attacker to pivot beyond the initial trust boundary.

The Exploit Prediction Scoring System (EPSS) currently rates the probability of exploitation at 0.27%. No public proof-of-concept code, CISA KEV listing, or in-the-wild exploitation has been reported at the time of publication.

Root Cause

Oracle has not published detailed root-cause information beyond the Critical Patch Update advisory. The advisory identifies the Messaging Enabler component as the vulnerable subsystem and confirms that the defect permits an authenticated network attacker to read data outside the intended authorization boundary. Because the scope changes upon exploitation, the underlying weakness likely involves improper access control or trust delegation between the Messaging Enabler and adjacent Fusion Middleware components.

Attack Vector

The attack originates over the network via HTTP. The attacker must hold a valid low-privileged account on the Service Delivery Platform. Once authenticated, the attacker sends crafted HTTP requests to the Messaging Enabler endpoints to retrieve data they are not authorized to view. The attack complexity is low and does not require user interaction, making the vulnerability practical to weaponize once credentials are obtained.

No verified exploitation code is publicly available. Refer to the Oracle Critical Patch Update Advisory - July 2026 for vendor guidance.

Detection Methods for CVE-2026-60440

Indicators of Compromise

• Unusual volumes of HTTP requests from low-privileged Service Delivery Platform accounts to Messaging Enabler endpoints.
• Authentication events from service accounts accessing messaging APIs outside of documented integration patterns.
• Outbound data transfers from Fusion Middleware hosts to unexpected destinations following authenticated messaging API calls.

Detection Strategies

• Enable verbose HTTP access logging on WebLogic managed servers hosting Service Delivery Platform and forward logs to a SIEM for correlation.
• Baseline normal query patterns for the Messaging Enabler component and alert on deviations, particularly requests returning large response bodies to low-privileged users.
• Correlate authentication logs with API access logs to identify accounts issuing requests inconsistent with their assigned roles.

Monitoring Recommendations

• Monitor Oracle Fusion Middleware audit logs for privilege boundary crossings between the Messaging Enabler and adjacent products.
• Track HTTP status code distributions on Messaging Enabler endpoints; sudden increases in successful 200 responses to previously restricted paths warrant investigation.
• Alert on any Service Delivery Platform account performing bulk data retrieval outside business hours.

How to Mitigate CVE-2026-60440

Immediate Actions Required

• Apply the July 2026 Oracle Critical Patch Update to affected Service Delivery Platform deployments running 12.2.1.4.0 or 14.1.2.0.0.
• Inventory all Fusion Middleware instances and confirm Messaging Enabler component versions.
• Review and rotate credentials for low-privileged accounts on Service Delivery Platform following patching.

Patch Information

Oracle released fixes for CVE-2026-60440 as part of the Oracle Critical Patch Update Advisory - July 2026. Administrators should follow the standard Oracle patching methodology, including backing up domain configurations and testing the patch in a non-production environment before rollout. Confirm patch levels post-installation using the OPatch utility.

Workarounds

• Restrict network access to Messaging Enabler HTTP endpoints using firewall rules or reverse proxy ACLs, limiting traffic to trusted integration hosts.
• Enforce the principle of least privilege by auditing and reducing the number of accounts with any level of access to the Service Delivery Platform.
• Enable web application firewall inspection in front of Fusion Middleware to log and rate-limit anomalous request patterns until patches are applied.

# Verify installed patch level on Oracle Fusion Middleware
cd $ORACLE_HOME/OPatch
./opatch lspatches

# Restrict inbound HTTP access to Messaging Enabler endpoints (example iptables rule)
iptables -A INPUT -p tcp --dport 7001 -s <trusted_integration_subnet> -j ACCEPT
iptables -A INPUT -p tcp --dport 7001 -j DROP