Oracle WebLogic Server CVE-2026-60196

Exploitation requires (1) network position on the adjacent physical communication segment attached to the hardware running WebLogic - the attacker cannot reach it from an arbitrary remote/internet location (AV:A), and (2) high existing privileges on that segment (PR:H). No user interaction is needed (UI:N) and attack complexity is low (AC:L), so given those two preconditions exploitation is straightforward and reliable. Affected deployments are limited to Oracle WebLogic Server versions 12.2.1.4.0 and 14.1.2.0.0 running the Core component; the dual requirement of adjacent access plus high privilege is the principal factor limiting real-world exploitability and distinguishes this from an internet-facing unauthenticated flaw.

The CVSS 3.1 base score is 8.4 (High), but the vector materially constrains real-world exposure: AV:A means the attacker must sit on the adjacent physical/logical communication segment (not routable from the internet), and PR:H means they must already hold high privileges there. These two factors are strong limiters that offset the otherwise severe S:C/C:H/I:H/A:H impacts. AC:L combined with Oracle's 'easily exploitable' phrasing indicates that once those preconditions are met, exploitation is reliable. No EPSS score, POC, or KEV entry is provided, so there is no evidence of active or opportunistic exploitation - the profile fits a targeted insider or lateral-movement threat model rather than mass internet exploitation. Note the mild conflict between the Information Disclosure tag and the full-impact vector; treat the vector as authoritative. Net priority: patch on the normal Oracle CPU cadence, prioritizing WebLogic hosts on shared or weakly-segmented management/cluster networks where a privileged foothold is plausible.

An attacker who has already gained a high-privileged foothold on a host in the same physical/logical network segment as a WebLogic node crafts malicious traffic against the Core communication layer of an unpatched 12.2.1.4.0 or 14.1.2.0.0 server. Exploitation takes over the WebLogic instance and, via the scope change, pivots into co-located Fusion Middleware or clustered products. No public exploit code is currently identified, so this would require attacker-developed tooling.