CVE-2026-60441: Oracle Service Delivery Platform RCE Flaw

CVE-2026-60441 Overview

CVE-2026-60441 is a critical vulnerability in the Messaging Enabler component of Oracle Service Delivery Platform, a product within Oracle Fusion Middleware. The flaw allows an unauthenticated remote attacker with network access via the T3 or Internet Inter-ORB Protocol (IIOP) to fully compromise the Service Delivery Platform. Affected versions are 12.2.1.4.0 and 14.1.2.0.0. Successful exploitation results in complete takeover of the platform, impacting confidentiality, integrity, and availability. Oracle disclosed the issue in the July 2026 Critical Patch Update.

Critical Impact
Unauthenticated attackers with network access to T3 or IIOP listeners can take over the Service Delivery Platform with no user interaction, resulting in full confidentiality, integrity, and availability compromise.

Affected Products

Oracle Service Delivery Platform 12.2.1.4.0
Oracle Service Delivery Platform 14.1.2.0.0
Oracle Fusion Middleware (Messaging Enabler component)

Discovery Timeline

2026-07-21 - CVE CVE-2026-60441 published to the National Vulnerability Database (NVD)
2026-07-21 - Last updated in NVD database
July 2026 - Oracle addresses the vulnerability in the Oracle Critical Patch Update Advisory - July 2026

Technical Details for CVE-2026-60441

Vulnerability Analysis

The vulnerability resides in the Messaging Enabler component of Oracle Service Delivery Platform. It is exposed through the T3 and IIOP remote protocols used by Oracle WebLogic-based Fusion Middleware deployments. Both protocols support Java object serialization, which historically has been a vector for pre-authentication remote code execution in Oracle middleware.

An unauthenticated attacker who can reach the T3 or IIOP listener over the network can trigger the flaw with a single crafted request. No privileges and no user interaction are required, and the impact spans confidentiality, integrity, and availability. Oracle classifies successful exploitation as a full takeover of the Service Delivery Platform, indicating attacker-controlled code execution or equivalent administrative control over the process.

Root Cause

Oracle has not published the underlying weakness class or CWE. Based on the affected component and the T3/IIOP attack surface, the vulnerability aligns with the deserialization and remote invocation weaknesses that have repeatedly affected Oracle Fusion Middleware. See the Oracle Critical Patch Update Advisory - July 2026 for authoritative technical details.

Attack Vector

The attack vector is network-based over T3 or IIOP, the remote invocation protocols exposed by Oracle WebLogic Server hosting the Service Delivery Platform. Attackers require only network reachability to the listener ports. Because the vulnerability is unauthenticated and low complexity, any exposed instance is directly reachable from adjacent networks or, where firewall rules permit, from the internet. No verified public exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified proof-of-concept code has been published. Refer to Oracle's advisory for remediation guidance rather than speculative exploitation examples.

Detection Methods for CVE-2026-60441

Indicators of Compromise

Unexpected inbound connections to WebLogic T3 (7001, 7002) or IIOP ports from untrusted networks.
New or anomalous child processes spawned by the WebLogic managed server hosting Service Delivery Platform.
Java stack traces or serialization errors in AdminServer.log and managed server logs referencing Messaging Enabler classes.
Creation of unfamiliar files under the domain directory, particularly staged JAR or class artifacts.

Detection Strategies

Inspect WebLogic access and audit logs for T3/IIOP requests from unauthenticated sources targeting the Messaging Enabler.
Correlate outbound network connections from the WebLogic JVM process with known-good baselines to identify command-and-control traffic.
Alert on process lineage where java under the WebLogic domain spawns shell interpreters such as sh, bash, cmd.exe, or powershell.exe.

Monitoring Recommendations

Enable WebLogic auditing at a level that captures remote invocation attempts and forward logs to a centralized SIEM.
Monitor filesystem writes under the WebLogic domain and application deployment directories for unauthorized changes.
Track authentication failures and connection attempts on T3/IIOP listeners to detect scanning and exploitation activity.

How to Mitigate CVE-2026-60441

Immediate Actions Required

Apply the Oracle July 2026 Critical Patch Update for Oracle Service Delivery Platform 12.2.1.4.0 and 14.1.2.0.0 without delay.
Restrict network access to WebLogic T3 and IIOP listeners so they are reachable only from trusted management networks.
Inventory all Oracle Fusion Middleware deployments and confirm whether the Messaging Enabler component is present.
Review WebLogic logs and host telemetry for signs of prior exploitation before and after patching.

Patch Information

Oracle addressed CVE-2026-60441 in the July 2026 Critical Patch Update. Administrators should download and apply the patches referenced in the Oracle Critical Patch Update Advisory - July 2026 for both affected versions. Oracle recommends applying Critical Patch Updates as soon as they are released.

Workarounds

Use the WebLogic connection filter (weblogic.security.net.ConnectionFilterImpl) to block or restrict T3 and IIOP traffic to known administrative hosts.
Disable IIOP in the WebLogic Server console for managed servers that do not require it.
Place the Service Delivery Platform behind a network segment that denies inbound traffic to T3/IIOP ports from untrusted zones.
Treat workarounds as temporary risk reduction only; patching remains required to remediate the vulnerability.

bash

# Example WebLogic connection filter rule to restrict T3/IIOP
# Configure via: Domain > Security > Filter > Connection Filter Rules
# Allow only management subnet, deny all others on T3, T3S, IIOP, IIOPS
10.10.0.0/24 * * allow t3 t3s iiop iiops
* * * deny t3 t3s iiop iiops