Oracle disclosed CVE-2026-60294, a critical (CVSS 9.8) vulnerability in Oracle WebLogic Server that lets an unauthenticated attacker fully compromise affected servers over the network via SOAP.
What Is It
CVE-2026-60294 is a vulnerability in the Core component of Oracle WebLogic Server, part of Oracle Fusion Middleware. According to Oracle's advisory, the flaw is "easily exploitable" and allows an unauthenticated attacker with network access via SOAP to compromise the server. Successful exploitation can result in complete takeover of Oracle WebLogic Server.
The vulnerability carries a CVSS 3.1 base score of 9.8 (CRITICAL), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This reflects network attack vector, low attack complexity, no privileges or user interaction required, and high impact to confidentiality, integrity, and availability.
Why It Matters
The combination of no authentication, low complexity, and remote network reachability makes this a top-priority patch. An attacker needs only network access to a vulnerable SOAP endpoint to achieve full server takeover; no credentials and no user interaction. WebLogic Server is widely deployed as middleware for enterprise applications, and a full takeover exposes all data and workloads the server handles. Internet-exposed WebLogic instances have historically been high-value targets for opportunistic attackers.
What's Vulnerable
Per Oracle, the following supported versions of Oracle WebLogic Server are affected:
- 12.2.1.4.0
- 14.1.1.0.0
- 14.1.2.0.0
- 15.1.1.0.0
The affected component is the WebLogic Server Core.
Patch Status
Oracle addressed this vulnerability in its Critical Patch Update for July 2026 (cpujul2026). Administrators should apply the fixes referenced in Oracle's July 2026 CPU advisory. Given the 9.8 severity and unauthenticated remote exploitation path, patching should be prioritized, particularly for any internet-facing WebLogic instances.
Note: This CVE is not present in the CISA Known Exploited Vulnerabilities (KEV) catalog based on the supplied data; no confirmation of active exploitation is available in the source material.
Sources
- Oracle Critical Patch Update Advisory; July 2026: https://www.oracle.com/security-alerts/cpujul2026.html
- NVD, CVE-2026-60294: https://nvd.nist.gov/vuln/detail/CVE-2026-60294