Oracle disclosed a critical (CVSS 9.8) flaw in the Oracle WebLogic Server Core component that lets an unauthenticated attacker take over the server over T3 or IIOP.
What Is It
CVE-2026-60672 is a vulnerability in the Core component of Oracle WebLogic Server, part of Oracle Fusion Middleware. Oracle describes it as easily exploitable: an unauthenticated attacker with network access via the T3 or IIOP protocols can compromise the server, and successful attacks result in full takeover of Oracle WebLogic Server.
The CVE was published on 2026-08-18 by Oracle ([email protected]) and currently carries NVD status "Received."
Why It Matters
The CVSS 3.1 base score is 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Every exploitability factor is at its worst setting, network attack vector, low complexity, no privileges, no user interaction, producing an exploitability subscore of 3.9. Impact is high across confidentiality, integrity, and availability (subscore 5.9).
In practical terms, anything that can reach a WebLogic T3 or IIOP listener can potentially own the server outright. There is no authentication barrier and no victim interaction required.
There is no CISA KEV entry supplied for this CVE, so active exploitation is not confirmed in the source material provided here.
What's Vulnerable
Oracle lists the following supported versions of Oracle WebLogic Server (Oracle Corporation) as affected:
- 12.2.1.4.0
- 14.1.1.0.0
- 14.1.2.0.0
- 15.1.1.0.0
Affected component: Core. Attack surface: T3 and IIOP network protocols.
No CPE entries were included in the NVD record at time of publication.
Patch Status
The single reference supplied in the NVD record points to a URL under Oracle's security-alerts path with an aug2026 slug. Treat that label with caution: Oracle ships Critical Patch Updates on a fixed quarterly cadence, January, April, July, and October, so there is no scheduled "August 2026 Critical Patch Update." An August advisory would have to be either an out-of-cycle Security Alert or a mislabeled link, and the supplied URL also does not follow Oracle's usual Critical Patch Update naming pattern, so it may not resolve at all.
Administrators should therefore not rely on the supplied link. Start from Oracle's Security Alerts index and identify the advisory that actually carries CVE-2026-60672; most likely the July 2026 Critical Patch Update, a subsequent quarterly CPU, or an interim Security Alert if Oracle published one out of band. Apply the fix listed there for your WebLogic release.
No specific required-action deadline or KEV remediation due date is present in the supplied source material.
Sources
- NVD, CVE-2026-60672: https://nvd.nist.gov/vuln/detail/CVE-2026-60672
- Advisory link carried in the NVD record: labeled as an August 2026 Critical Patch Update, which does not match Oracle's quarterly CPU schedule; verify before use: https://www.oracle.com/security-alerts/cspuaug2026.html
- Oracle Security Alerts index (authoritative starting point for Critical Patch Updates and out-of-cycle Security Alerts): https://www.oracle.com/security-alerts/