Oracle disclosed a CVSS 9.8 flaw in the WebLogic Server Core component that lets an unauthenticated remote attacker take over the server via T3 or IIOP.
What Is It
CVE-2026-60696 is a vulnerability in the Core component of Oracle WebLogic Server, part of Oracle Fusion Middleware. Oracle describes it as an easily exploitable flaw that allows an unauthenticated attacker with network access over the T3 or IIOP protocols to compromise the server. Successful exploitation results in complete takeover of the WebLogic Server instance.
The CVSS 3.1 base score is 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network attack vector, low complexity, no privileges, no user interaction, with high confidentiality, integrity, and availability impact. The exploitability subscore is the maximum 3.9.
Why It Matters
Every barrier that normally slows an attacker is absent here: no credentials, no user interaction, no complex preconditions. T3 and IIOP are WebLogic's remote protocols, and where they are reachable from untrusted networks the path to full server takeover is direct. WebLogic typically fronts business-critical Fusion Middleware and Java EE application stacks, so a takeover puts application data, credentials, and downstream integrations in scope.
The available source material contains no evidence of active exploitation in the wild. The record is newly published (2026-08-18) and remains in "Received" status at NVD, meaning NVD analysis is still pending; enrichment, references, and any exploitation signal may change as the record is processed.
What's Vulnerable
Oracle lists these supported versions of Oracle WebLogic Server as affected:
- 12.2.1.4.0
- 14.1.1.0.0
- 14.1.2.0.0
- 15.1.1.0.0
Affected component: Core. Vendor: Oracle Corporation. Attack surface: T3 and IIOP network access.
Patch Status
Oracle ships WebLogic Server fixes through its Critical Patch Update program, supplemented by out-of-cycle Security Alerts when circumstances warrant. The available source material does not identify which specific advisory carries the fix for this CVE, and no fixed version or patch identifier can be confirmed from it. Administrators should check Oracle's own security advisory listings and My Oracle Support for the patch that applies to their installed version rather than relying on a release date inferred from the CVE record.
Independent of patch timing, and consistent with Oracle's stated attack vector, review whether T3 and IIOP need to be exposed beyond trusted network segments. Restricting or filtering those protocols at the network boundary removes the reachability that the CVSS 9.8 rating assumes.
Sources
- Oracle security alerts link as carried in the source record; unverified, may not resolve to a published advisory: https://www.oracle.com/security-alerts/cspuaug2026.html
- NVD, CVE-2026-60696: https://nvd.nist.gov/vuln/detail/CVE-2026-60696