Oracle WebLogic Server CVE-2026-60153

Exploitation requires the attacker to already possess high-privileged (administrative) access to the WebLogic Administration Console plus network reachability to that Console over HTTPS (CVSS PR:H, AV:N, AC:L, UI:N). No end-user interaction is needed and attack complexity is low, but the PR:H requirement is the decisive limiting factor: an unprivileged or unauthenticated remote attacker cannot exploit this directly. It applies to WebLogic Console in supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0; exposure is further limited where the Administration Console is network-restricted rather than broadly HTTPS-accessible.

The CVSS 3.1 base score is 7.2 (High) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The dominant limiting factor is PR:H - exploitation requires high privileges, meaning the attacker must already hold an administrative/privileged Console account before the network-reachable, low-complexity attack becomes viable. This significantly lowers real-world risk versus an unauthenticated RCE: it is primarily a privilege-abuse / escalation-to-takeover issue rather than a mass-exploitable perimeter bug. No EPSS score, SSVC decision, KEV listing, or POC was provided, so automatability and in-the-wild activity cannot be assessed from the input; treat likelihood as low-to-moderate pending EPSS/vendor data. The 'Information Disclosure' tag conflicts with the C:H/I:H/A:H impacts and the 'takeover' language - the impact metrics and description should be trusted over the tag, but this discrepancy is worth verifying with Oracle. Net: patch on a normal Oracle CPU cadence; given PR:H this is not a drop-everything perimeter emergency.

An attacker who has obtained or been granted a high-privileged WebLogic administrator credential (for example a compromised operator account or an over-provisioned internal user) connects to the WebLogic Administration Console over HTTPS. Using the vulnerable Console functionality they escalate that access into full control of the server, resulting in takeover with high confidentiality, integrity and availability impact. No public exploit code has been identified at time of analysis, and the low attack complexity means that once privileged access exists, exploitation is straightforward.