A critical, easily exploitable vulnerability in Oracle WebLogic Server allows an unauthenticated network attacker to fully compromise and take over affected servers.
What Is It
CVE-2026-60205 is a critical vulnerability in the Core component of Oracle WebLogic Server, part of Oracle Fusion Middleware. According to Oracle's advisory, the flaw allows an unauthenticated attacker with network access via TCP to compromise Oracle WebLogic Server. Successful exploitation can result in complete takeover of the server. It carries a CVSS 3.1 base score of 9.8 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact to confidentiality, integrity, and availability.
Why It Matters
This vulnerability combines the worst attributes for defenders: it is remotely reachable over the network, requires no authentication, needs no user interaction, and is described by Oracle as "easily exploitable." Because successful attacks lead to full takeover of the WebLogic Server, an attacker can gain complete control over the affected system, its data, and any services it hosts. WebLogic servers frequently sit at the core of enterprise application stacks, making a takeover a high-value outcome for attackers.
What's Vulnerable
The supported, affected versions of Oracle WebLogic Server are:
- 12.2.1.4.0
- 14.1.2.0.0
The affected component is the Core of Oracle WebLogic Server within Oracle Fusion Middleware.
Patch Status
Oracle addressed this vulnerability in its July 2026 Critical Patch Update. Organizations running the affected versions should apply the fixes referenced in Oracle's Critical Patch Update advisory (cpujul2026). No CISA KEV entry was supplied for this CVE, so active exploitation is not confirmed by KEV in the provided source material, and no KEV-mandated remediation deadline is available. Given the 9.8 severity and unauthenticated remote takeover potential, prompt patching is strongly warranted regardless.
Sources
- Oracle Critical Patch Update Advisory (July 2026), https://www.oracle.com/security-alerts/cpujul2026.html
- NVD, CVE-2026-60205, https://nvd.nist.gov/vuln/detail/CVE-2026-60205