Oracle WebLogic Server CVE-2026-60198

Exploitation requires network reachability to Oracle WebLogic Server's T3 or IIOP remoting listener (T3 defaults to TCP 7001, plus any IIOP and SSL-enabled variants) on a supported affected version (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0). No authentication, no user interaction, and no non-default configuration are needed - the CVSS vector is AV:N/AC:L/PR:N/UI:N, so this is remote unauthenticated exploitation against default configurations where the T3/IIOP ports are exposed. The principal limiting factor is exposure of those protocols: environments that firewall T3/IIOP to trusted hosts, disable IIOP, or apply WebLogic connection filters materially raise the bar, since an attacker with no network path to the listener cannot trigger the flaw.

All hard signals point to top-tier priority: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8) means remote, low-complexity, unauthenticated, no-user-interaction exploitation with total CIA compromise, and Oracle explicitly calls it 'easily exploitable.' EPSS is not provided in this input, and the CVE is not in CISA KEV, so there is no confirmed active exploitation yet and no public POC identified at time of analysis - the risk here is inferred from vector plus WebLogic's well-documented history of mass-exploited T3/IIOP deserialization bugs rather than from observed attacks. There is no SSVC record supplied. The one caveat: the vendor tag says 'Information Disclosure,' which conflicts with the description's 'takeover' and the I:H/A:H impacts - treat the tag as an imprecise label and trust the full-CIA vector and 'takeover' wording, but verify exact impact against Oracle's July 2026 CPU advisory. Net: high real-world priority for any internet- or partner-facing WebLogic instance, driven by the unauthenticated network vector and product's exposure profile.

An attacker who can reach the WebLogic T3/IIOP listener (e.g., an internet-exposed or partner-network 7001 port) sends a single crafted remoting request that the server processes without authentication, resulting in code execution and full takeover of the server. No credentials, user interaction, or non-default feature is required per the CVSS vector, so exploitation is a direct one-shot network request. No public POC is identified at time of analysis, but WebLogic T3/IIOP deserialization exploits are historically fast to appear once details circulate.