A critical vulnerability in Oracle WebLogic Server lets an unauthenticated attacker with network access fully compromise the server via SOAP, earning a maximum-tier CVSS score of 9.8.
What Is It
CVE-2026-60200 is a critical flaw in the Core component of Oracle WebLogic Server, part of Oracle Fusion Middleware. According to Oracle's advisory, the vulnerability is "easily exploitable" and allows an unauthenticated attacker with network access via SOAP to compromise the server. A successful attack can result in complete takeover of Oracle WebLogic Server, impacting confidentiality, integrity, and availability alike.
Why It Matters
The vulnerability carries a CVSS 3.1 base score of 9.8 (CRITICAL) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Every attribute favors the attacker: network attack vector, low complexity, no privileges required, and no user interaction. WebLogic servers frequently sit at the edge of enterprise application environments, and a network-reachable, unauthenticated path to full server takeover is exactly the kind of flaw that draws opportunistic mass exploitation. The impact scores, 3.9 exploitability and 5.9 impact, reflect a low barrier to entry paired with total compromise.
What's Vulnerable
Per the NVD record, the following supported versions of Oracle WebLogic Server are affected:
- 12.2.1.4.0
- 14.1.1.0.0
- 14.1.2.0.0
- 15.1.1.0.0
Patch Status
Oracle addressed this issue in its July 2026 Critical Patch Update (cpujul2026). Organizations running any affected version should apply the fixes from that Critical Patch Update advisory. The supplied source material does not include a CISA KEV entry for this CVE, so there is no confirmation of active exploitation in the provided data at this time.
Sources
- Oracle Critical Patch Update Advisory; July 2026: https://www.oracle.com/security-alerts/cpujul2026.html
- NVD, CVE-2026-60200: https://nvd.nist.gov/vuln/detail/CVE-2026-60200