Oracle disclosed a critical vulnerability in the Core component of Oracle WebLogic Server that lets a low-privileged, network-adjacent attacker take over the server outright and reach beyond it into other products.
What Is It
CVE-2026-60702 is a vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware, specifically the Core component. Oracle describes it as easily exploitable: an attacker with low privileges and network access over the T3 or IIOP protocols can compromise the server. No user interaction is required. Successful exploitation results in complete takeover of Oracle WebLogic Server.
The flaw carries a CVSS 3.1 base score of 9.9 (CRITICAL), with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, network attack vector, low complexity, low privileges required, no user interaction, and high impact to confidentiality, integrity, and availability.
Why It Matters
The scope-changed rating (S:C) is the part worth pausing on. Oracle notes that while the vulnerability resides in WebLogic Server, attacks may significantly impact additional products. Compromise does not stop at the WebLogic boundary; the blast radius extends to whatever else the middleware layer fronts.
WebLogic's T3 and IIOP protocols have a long operational history as remote attack surface, and this entry follows that pattern: low privileges, low complexity, full takeover. The 3.1 exploitability sub-score is near the practical maximum.
CISA KEV: no KEV entry was supplied for this CVE, so there is no confirmed evidence of active exploitation in the wild at this time.
What's Vulnerable
Oracle lists the following supported versions of Oracle WebLogic Server as affected:
- 12.2.1.4.0
- 14.1.1.0.0
- 14.1.2.0.0
- 15.1.1.0.0
Vendor: Oracle Corporation. Component: Core.
Patch Status
The CVE was published 2026-08-18 with a vulnerability status of "Received," and the source identifier is Oracle's security alert address. The single supplied reference is Oracle's August 2026 Critical Patch Update advisory, which is the authoritative source for fixed versions and patch availability. No KEV-mandated remediation deadline or required action was supplied for this CVE.
Administrators running any of the four affected versions should consult the Oracle advisory below and apply the associated patch. Restricting network exposure of T3 and IIOP listeners remains consistent with the described attack path.
Sources
- Oracle Critical Patch Update Advisory (August 2026), https://www.oracle.com/security-alerts/cspuaug2026.html
- NVD, CVE-2026-60702, https://nvd.nist.gov/vuln/detail/CVE-2026-60702