SYS::ONLINE
Wasteland.
Briefs1404
Issues20
SinceFeb 2026
LIVE
⚡ Active KEV CVE-2026-60198 2026-07-21

CVE-2026-60198: Critical Unauthenticated RCE in Oracle WebLogic Server

"A critical (CVSS 9.8) flaw in Oracle WebLogic Server lets an unauthenticated attacker fully compromise the server over the network via T3 or IIOP, with patches available in Oracle's July 2026 Critical Patch Update."

A critical (CVSS 9.8) flaw in Oracle WebLogic Server lets an unauthenticated attacker fully compromise the server over the network via T3 or IIOP, with patches available in Oracle's July 2026 Critical Patch Update.

What Is It

CVE-2026-60198 is a vulnerability in the Core component of Oracle WebLogic Server, part of Oracle Fusion Middleware. According to Oracle's advisory, it is an "easily exploitable" flaw that allows an unauthenticated attacker with network access via the T3 or IIOP protocols to compromise the server. Successful exploitation can result in a complete takeover of Oracle WebLogic Server. It carries a CVSS 3.1 base score of 9.8 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, reflecting high impact to confidentiality, integrity, and availability.

Why It Matters

The combination of network attack vector, low attack complexity, and no required privileges or user interaction makes this an attractive target. WebLogic is widely deployed as enterprise middleware, and its T3/IIOP protocols have a long history of being exposed and abused. Full server takeover without authentication means an attacker could seize application data and use the host as a foothold for lateral movement.

What's Vulnerable

Per the NVD record, the affected supported versions of Oracle WebLogic Server are:

Exposure is greatest where the T3 or IIOP protocols are reachable from untrusted networks.

Patch Status

Oracle addressed this vulnerability in its July 2026 Critical Patch Update (cpujul2026). Administrators should apply the fixes from that Critical Patch Update without delay and restrict or filter T3/IIOP access where feasible.

At the time of this writing, the supplied source material contains no CISA KEV entry for CVE-2026-60198, so there is no confirmation of active exploitation in the wild from KEV.

Sources