A critical, easily exploitable flaw in Oracle WebLogic Server's Core component lets an unauthenticated network attacker fully take over affected servers.
What Is It
CVE-2026-60292 is a vulnerability in the Core component of Oracle WebLogic Server, part of Oracle Fusion Middleware. According to Oracle's advisory, the flaw is "easily exploitable" and allows an unauthenticated attacker with network access via HTTP to compromise the server. Successful exploitation can result in complete takeover of the WebLogic Server instance.
The issue carries a CVSS 3.1 base score of 9.8 (CRITICAL), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, reflecting network attack vector, low complexity, no privileges or user interaction required, and high impact to confidentiality, integrity, and availability.
Why It Matters
The combination of no authentication, no user interaction, low attack complexity, and network reach over HTTP makes this vulnerability trivial to exploit against exposed servers. A successful attack yields full takeover of the WebLogic Server, giving an attacker complete control over the confidentiality, integrity, and availability of the affected system. WebLogic Servers are commonly internet-facing application middleware, making them high-value targets.
What's Vulnerable
Per the NVD record, the affected supported versions of Oracle WebLogic Server are:
- 12.2.1.4.0
- 14.1.1.0.0
Both versions are listed as affected by Oracle Corporation in the vulnerability data.
Patch Status
Oracle addressed this vulnerability in its Critical Patch Update for July 2026. Administrators should consult the Oracle Critical Patch Update advisory (cpujul2026) and apply the relevant fixes for their WebLogic Server version. No CISA KEV entry was supplied for this CVE, so active exploitation is not confirmed by KEV in the available source material.
Sources
- Oracle Critical Patch Update Advisory; July 2026: https://www.oracle.com/security-alerts/cpujul2026.html
- NVD, CVE-2026-60292: https://nvd.nist.gov/vuln/detail/CVE-2026-60292