What is the CVSS score of CVE-2026-60153?

CVE-2026-60153 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebLogic Server are affected by CVE-2026-60153?

Oracle WebLogic Server console management in Fusion Middleware versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 can be fully compromised by privileged administrators, resulting in complete…

How to fix or mitigate CVE-2026-60153?

Within 24 hours, inventory all Oracle WebLogic Server instances running affected Fusion Middleware versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) and restrict administrative console access to essential accounts only. Within 7 days, apply Oracle's July 2026 Critical Patch Update to all identified instances, prioritizing production systems. By day 30, verify successful patch deployment across all systems and audit administrative console access logs from the prior 30 days to identify any unauthorized access attempts.

Oracle WebLogic Server CVE-2026-60153

EUVD-2026-46559 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 oracle

GHSA-jhvx-53r8-58rj

Privilege Escalation Oracle Oracle Weblogic Server Oracle Corporation

7.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network-reachable Console (AV:N) with low complexity (AC:L) but requires an existing high-privileged admin account (PR:H); no user interaction and full C/I/A takeover.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:13 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

HIGH 7.2

DescriptionCVE.org

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full server takeover of Oracle WebLogic Server (Fusion Middleware, Console component) is achievable by an already-authenticated high-privileged attacker reaching the management Console over HTTPS. Affected supported releases are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, and successful exploitation yields complete compromise of confidentiality, integrity and availability. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; it is addressed in Oracle's July 2026 Critical Patch Update.

Technical ContextAI

Oracle WebLogic Server is a Java EE application server and a core component of Oracle Fusion Middleware, widely used to host enterprise Java applications and SOA/middleware workloads. The flaw resides in the administrative Console component - the web-based management interface used to configure domains, deploy applications and manage server runtime. Oracle did not assign a CWE (CWE: N/A), and while the tags label this 'Information Disclosure', the CVSS impacts (C:H/I:H/A:H) and the description's explicit 'takeover' outcome indicate the root cause enables far more than disclosure - most likely an authenticated administrative function abused to execute code or reconfigure the server. The affected products are identified by CPE cpe:2.3:a:oracle_corporation:oracle_weblogic_server:*:*:*:*:*:*:*:*.

RemediationAI

Apply the fixes from the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) for your WebLogic release line (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 or 15.1.1.0.0); Patch available per vendor advisory, though a specific fixed build number was not provided in the input and should be taken directly from the CPU patch matrix. Because exploitation requires a high-privileged Console account, the most effective compensating controls are to tightly restrict and audit WebLogic administrative accounts, enforce least privilege, and rotate/strengthen admin credentials. Where feasible, isolate the Administration Console: bind it to a dedicated admin network, place it behind a VPN or firewall so it is not broadly reachable over HTTPS, and restrict source IPs to trusted administrator hosts - the trade-off is added operational friction for legitimate administrators. Enable and monitor Console access and configuration-change logging to detect abuse of privileged sessions until patching is complete.