What is the CVSS score of CVE-2026-60196?

CVE-2026-60196 has a CVSS 3.1 base score of 8.4 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Oracle WebLogic Server are affected by CVE-2026-60196?

Oracle WebLogic Server versions 12.2.1.4.0 and 14.1.2.0.0 are vulnerable to CVE-2026-60196, a CVSS 8.4 flaw enabling complete server takeover and impact to dependent systems through privileged…

How to fix or mitigate CVE-2026-60196?

Within 24 hours, conduct a complete inventory of Oracle WebLogic Server deployments to identify all instances running versions 12.2.1.4.0 or 14.1.2.0.0 and document their network exposure and business criticality. Within 7 days, apply Oracle's July 2026 Critical Patch Update to all identified affected WebLogic systems, prioritizing business-critical instances. Within 30 days, verify successful patch installation across the entire WebLogic estate, confirm no systems show indicators of compromise, and review network segmentation controls to restrict access to WebLogic infrastructure from adjacent network segments.

Oracle WebLogic Server CVE-2026-60196

EUVD-2026-46602 HIGH

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-cwj7-79pq-6rff

Authentication Bypass Oracle Oracle Weblogic Server Oracle Corporation

8.4

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.4 HIGH

AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

8.4 HIGH

Adjacent-segment access gives AV:A, the required high privilege gives PR:H, no interaction UI:N, and cross-product impact justifies S:C with full C/I/A high.

3.1 AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:05 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

HIGH 8.4

DescriptionCVE.org

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the Oracle WebLogic Server executes to compromise Oracle WebLogic Server. While the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Full server takeover in Oracle WebLogic Server 12.2.1.4.0 and 14.1.2.0.0 (Core component) allows a high-privileged attacker positioned on the adjacent physical communication segment to compromise the server and, due to a scope change, significantly impact additional connected products. Successful exploitation yields complete loss of confidentiality, integrity, and availability. No public exploit is identified at time of analysis and the issue is not listed in CISA KEV; Oracle addressed it in the July 2026 Critical Patch Update.

Technical ContextAI

Oracle WebLogic Server is a Java EE / Jakarta EE application server that forms the runtime backbone of Oracle Fusion Middleware, hosting enterprise Java applications, web services, and clustered deployments. The flaw resides in the Core component and, per the CVSS scope change (S:C), a compromise of the WebLogic runtime crosses a trust boundary to affect other products sharing the environment (for example clustered nodes, back-end data sources, or co-located middleware). The affected identifier is cpe:2.3:a:oracle_corporation:oracle_weblogic_server, covering the 12.2.1.4.0 and 14.1.2.0.0 release trains. Oracle assigned no CWE, so the precise root-cause class is unconfirmed; the Information Disclosure tag alongside full C/I/A impact points toward a protocol- or communication-layer weakness reachable from the same network segment rather than a purely application-layer input flaw.

RemediationAI

Apply the fixes from the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); patch available per vendor advisory for the affected 12.2.1.4.0 and 14.1.2.0.0 release trains - Oracle bundles fixes in the CPU rather than as standalone version numbers, so consult the CPU patch matrix for the exact bundle/patch IDs for your platform. Because the attack requires adjacent-network access, the most effective interim compensating control is tightening segmentation: isolate WebLogic administration, cluster-replication, and T3/IIOP traffic onto a dedicated VLAN with strict ACLs so untrusted hosts cannot reach the communication segment (trade-off: verify legitimate admin and cluster nodes retain connectivity to avoid breaking replication). Additionally restrict and audit which accounts hold high privileges on those hosts, since PR:H is a required precondition. These are stopgaps only - the CPU patch is the durable fix.