CVE-2026-60861: Oracle SDP Auth Bypass Vulnerability

CVE-2026-60861 Overview

CVE-2026-60861 is a critical vulnerability in the Oracle Service Delivery Platform (SDP), a component of Oracle Fusion Middleware. The flaw resides in the Messaging Enabler component and affects supported versions 14.1.2.0.0 and 12.2.1.4.0. A low-privileged attacker with network access via Oracle Net can exploit the weakness to compromise the Service Delivery Platform. The vulnerability introduces a scope change, meaning successful exploitation can affect resources beyond the vulnerable component. Impacts include unauthorized creation, deletion, or modification of critical data, and unauthorized read access to all SDP-accessible data. The weakness is classified under [CWE-284: Improper Access Control].

Critical Impact
Low-privileged network attackers can compromise Oracle Service Delivery Platform data confidentiality and integrity across a wider scope than the affected component itself.

Affected Products

Oracle Fusion Middleware – Service Delivery Platform 14.1.2.0.0
Oracle Fusion Middleware – Service Delivery Platform 12.2.1.4.0
Messaging Enabler component within the above SDP releases

Discovery Timeline

2026-08-18 - CVE-2026-60861 published to NVD
2026-08-20 - Last updated in NVD database
2026-08-20 - EPSS score published at 0.373% (percentile 30.6)

Technical Details for CVE-2026-60861

Vulnerability Analysis

The vulnerability affects the Messaging Enabler component within Oracle Service Delivery Platform. Attackers reach the component over the network using Oracle Net, Oracle's proprietary client-server communication protocol. Exploitation requires only low-level privileges and no user interaction. Because the vulnerability produces a scope change, successful attacks can affect additional Oracle products beyond the SDP boundary. The impact profile covers confidentiality and integrity but not availability, indicating the flaw enables data disclosure and tampering rather than service disruption. Refer to the Oracle Security Alert for authoritative product details.

Root Cause

The root cause is improper access control ([CWE-284]) in the Messaging Enabler component. The component does not adequately restrict actions available to low-privileged authenticated principals. This allows those principals to reach messaging pathways and data structures that should require higher authorization. The resulting scope change indicates a trust boundary violation between the SDP component and adjacent Oracle Fusion Middleware services.

Attack Vector

An attacker requires network reachability to the Oracle Net listener and a low-privileged account on the target SDP deployment. The attacker sends crafted requests through Oracle Net to the Messaging Enabler component. Because attack complexity is low and user interaction is not required, exploitation can be automated once network access and credentials are obtained. No public proof-of-concept exploit is available at the time of publication.

No verified exploitation code is publicly available. Technical specifics beyond the advisory have not been released by Oracle. Consult the Oracle Security Alert for vendor-supplied details.

Detection Methods for CVE-2026-60861

Indicators of Compromise

Unexpected Oracle Net connections to SDP Messaging Enabler endpoints from low-privileged service accounts
Anomalous read or write operations on SDP-managed data by accounts that historically do not perform such operations
Messaging Enabler log entries showing message flows crossing product boundaries within Fusion Middleware

Detection Strategies

Baseline normal Oracle Net client behavior against SDP listeners and alert on deviations in source, frequency, or operation type
Enable and centrally collect Oracle Fusion Middleware audit logs, including SDP and Messaging Enabler activity, for correlation
Compare authenticated principal privilege levels against the sensitivity of the data or resources they access

Monitoring Recommendations

Forward Oracle Net listener logs, SDP application logs, and Fusion Middleware audit trails to a centralized analytics platform
Track configuration changes to Messaging Enabler and adjacent components as high-value events
Monitor east-west traffic between SDP hosts and other Fusion Middleware services for scope-crossing message patterns

How to Mitigate CVE-2026-60861

Immediate Actions Required

Apply the fixes provided in the Oracle Security Alert for affected SDP versions 14.1.2.0.0 and 12.2.1.4.0
Inventory all Oracle Fusion Middleware deployments and identify hosts running Service Delivery Platform
Review and reduce the population of low-privileged accounts that can reach SDP over Oracle Net
Restrict Oracle Net listener exposure to trusted management networks only

Patch Information

Oracle addressed CVE-2026-60861 in its August 2026 security update cycle. Administrators should follow the guidance published in the Oracle Security Alert and apply the corresponding Critical Patch Update to SDP 14.1.2.0.0 and 12.2.1.4.0 installations. Validate patch application through Oracle's opatch inventory tooling and confirm component versions after deployment.

Workarounds

Enforce network segmentation so that only authorized middle-tier hosts can reach the Oracle Net listener serving SDP
Rotate credentials for low-privileged accounts with SDP access and enforce strong authentication controls
Disable or restrict the Messaging Enabler component where not required for business operations, pending patch deployment

bash

# Configuration example: restrict Oracle Net access via sqlnet.ora
# Limit which client hosts can connect to the SDP listener
tcp.validnode_checking = yes
tcp.invited_nodes = (10.10.20.15, 10.10.20.16, sdp-app01.internal)
tcp.excluded_nodes = (0.0.0.0/0)