A critical, easily exploitable flaw in the Core component of Oracle WebLogic Server lets an unauthenticated network attacker take over the server, carrying a maximum-severity CVSS score of 9.8.
What Is It
CVE-2026-60202 is a vulnerability in the Core component of Oracle WebLogic Server, part of Oracle Fusion Middleware. Per Oracle's advisory, it is an "easily exploitable" vulnerability that allows an unauthenticated attacker with network access via the T3 and IIOP protocols to compromise the server. Successful exploitation can result in complete takeover of Oracle WebLogic Server.
Why It Matters
The flaw carries a CVSS 3.1 base score of 9.8 (CRITICAL) with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That means it is exploitable over the network, requires low attack complexity, needs no privileges, and requires no user interaction; while delivering HIGH impact to confidentiality, integrity, and availability. The combination of no authentication and full server takeover makes this an urgent priority for any exposed WebLogic deployment.
What's Vulnerable
Oracle lists the following supported WebLogic Server versions as affected:
- 12.2.1.4.0
- 14.1.1.0.0
- 14.1.2.0.0
- 15.1.1.0.0
The attack surface is exposure of the T3 and IIOP protocols to untrusted networks.
Patch Status
Oracle addressed this vulnerability in the July 2026 Critical Patch Update (CPU). Administrators should apply the fixes referenced in Oracle's July 2026 CPU advisory. No CISA KEV entry confirming active exploitation was supplied with this record.