CVE-2026-60442: Oracle Service Delivery Platform RCE Flaw

CVE-2026-60442 Overview

CVE-2026-60442 is a critical vulnerability in the Oracle Service Delivery Platform, part of Oracle Fusion Middleware. The flaw resides in the Messaging Enabler component and affects supported versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via T3 or IIOP protocols can exploit this vulnerability with low complexity. Successful exploitation results in full takeover of the Service Delivery Platform, compromising confidentiality, integrity, and availability. Oracle disclosed the issue in the July 2026 Critical Patch Update.

Critical Impact
Unauthenticated remote attackers can take full control of Oracle Service Delivery Platform instances through exposed T3 or IIOP endpoints.

Affected Products

Oracle Service Delivery Platform 12.2.1.4.0
Oracle Service Delivery Platform 14.1.2.0.0
Oracle Fusion Middleware (Messaging Enabler component)

Discovery Timeline

2026-07-21 - CVE-2026-60442 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60442

Vulnerability Analysis

The vulnerability affects the Messaging Enabler component of Oracle Service Delivery Platform. Oracle Fusion Middleware exposes T3 (Oracle WebLogic proprietary RMI protocol) and IIOP (Internet Inter-ORB Protocol) endpoints used for internal cluster and client communication. Attackers reachable over the network can send crafted protocol messages to the Messaging Enabler without any credentials or user interaction.

The attack results in a complete compromise of the Service Delivery Platform, providing the adversary full read, write, and denial-of-service capability against the affected service.

Root Cause

Oracle has not published detailed root cause analysis for CVE-2026-60442. Vulnerabilities of this class in T3 and IIOP handlers historically involve insecure deserialization of untrusted Java objects, allowing arbitrary object graph reconstruction and gadget-chain execution during protocol message processing.

Attack Vector

The attack vector is network-based over T3 or IIOP. Both protocols are enabled by default on WebLogic-based Fusion Middleware deployments and often listen on the same port as HTTP administrative traffic. An attacker sends a specially crafted protocol payload to the exposed listener, and the Messaging Enabler processes the request without authentication. Refer to the Oracle Critical Patch Update - July 2026 for vendor-specific guidance.

Detection Methods for CVE-2026-60442

Indicators of Compromise

Unexpected inbound connections to WebLogic T3 listener ports (default 7001, 7002) from untrusted networks
Anomalous IIOP traffic patterns targeting Oracle Fusion Middleware managed servers
New or unexplained Java processes, child shells, or outbound connections spawned by WebLogic managed server processes
Modification of WebLogic domain directories, deployment of unknown WAR/EAR artifacts, or unexpected scheduled jobs

Detection Strategies

Inspect WebLogic access and audit logs for malformed T3 or IIOP handshake sequences and abnormal serialized payload sizes
Monitor process lineage from java WebLogic processes for unusual child processes such as cmd.exe, powershell.exe, /bin/sh, or curl
Correlate network telemetry with endpoint telemetry to flag T3/IIOP traffic originating from outside expected administrative subnets

Monitoring Recommendations

Enable and centralize WebLogic server logs, HTTP access logs, and JVM audit logs in a SIEM for retrospective analysis
Alert on failed and successful RMI/JNDI lookups initiated by managed servers to external hosts
Track outbound connections from Fusion Middleware hosts to uncommon destinations, especially LDAP, DNS, and HTTP callbacks used in deserialization exploits

How to Mitigate CVE-2026-60442

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all affected Oracle Service Delivery Platform installations
Inventory all Fusion Middleware deployments running 12.2.1.4.0 and 14.1.2.0.0 and prioritize internet-exposed instances
Restrict network access to T3 and IIOP listener ports to trusted administrative networks only
Review Fusion Middleware hosts for signs of prior compromise before and after patching

Patch Information

Oracle released fixes for CVE-2026-60442 in the July 2026 Critical Patch Update. Administrators should consult the Oracle Critical Patch Update - July 2026 advisory for the exact patch bundles, patch numbers, and installation prerequisites for versions 12.2.1.4.0 and 14.1.2.0.0.

Workarounds

Configure the WebLogic Connection Filter (weblogic.security.net.ConnectionFilterImpl) to deny T3 and T3s traffic from untrusted sources
Disable IIOP on managed servers where the protocol is not required for application functionality
Place Fusion Middleware behind a network segment or reverse proxy that terminates only required HTTP/HTTPS traffic and blocks T3/IIOP externally
Enforce strict egress filtering to prevent successful callback stages of deserialization payloads

bash

# Example WebLogic Connection Filter rules to block T3/IIOP from untrusted networks
# Set in Administration Console: Domain > Security > Filter

# Deny all external T3/T3S/IIOP; allow only internal management subnet
0.0.0.0/0 * * deny t3 t3s iiop iiops
10.0.0.0/8  * * allow t3 t3s iiop iiops