SYS::ONLINE
Wasteland.
Briefs1481
Issues20
SinceFeb 2026
LIVE
⚡ Active KEV CVE-2026-60292 2026-07-21

CVE-2026-60292: Critical Unauthenticated Takeover in Oracle WebLogic Server

"A critical, easily exploitable flaw in Oracle WebLogic Server's Core component lets an unauthenticated network attacker fully take over affected servers."

A critical, easily exploitable flaw in Oracle WebLogic Server's Core component lets an unauthenticated network attacker fully take over affected servers.

What Is It

CVE-2026-60292 is a vulnerability in the Core component of Oracle WebLogic Server, part of Oracle Fusion Middleware. According to Oracle's advisory, the flaw is "easily exploitable" and allows an unauthenticated attacker with network access via HTTP to compromise the server. Successful exploitation can result in complete takeover of the WebLogic Server instance.

The issue carries a CVSS 3.1 base score of 9.8 (CRITICAL), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, reflecting network attack vector, low complexity, no privileges or user interaction required, and high impact to confidentiality, integrity, and availability.

Why It Matters

The combination of no authentication, no user interaction, low attack complexity, and network reach over HTTP makes this vulnerability trivial to exploit against exposed servers. A successful attack yields full takeover of the WebLogic Server, giving an attacker complete control over the confidentiality, integrity, and availability of the affected system. WebLogic Servers are commonly internet-facing application middleware, making them high-value targets.

What's Vulnerable

Per the NVD record, the affected supported versions of Oracle WebLogic Server are:

Both versions are listed as affected by Oracle Corporation in the vulnerability data.

Patch Status

Oracle addressed this vulnerability in its Critical Patch Update for July 2026. Administrators should consult the Oracle Critical Patch Update advisory (cpujul2026) and apply the relevant fixes for their WebLogic Server version. No CISA KEV entry was supplied for this CVE, so active exploitation is not confirmed by KEV in the available source material.

Sources