What is the CVSS score of CVE-2026-60198?

CVE-2026-60198 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebLogic Server are affected by CVE-2026-60198?

Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 are vulnerable to complete server takeover by unauthenticated remote attackers through T3 and IIOP remoting…

How to fix or mitigate CVE-2026-60198?

Within 24 hours, inventory all systems running Oracle WebLogic Server 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0 and immediately block external access to T3 (port 7001) and IIOP (port 7002) protocols using firewall rules, permitting only trusted administrative networks. Within 7 days, implement network segmentation to isolate affected WebLogic instances from untrusted networks, configure detailed logging and alerting on T3/IIOP connection attempts, and begin pre-production testing of available patches. Within 30 days, apply the vendor patch to all affected systems upon release, or execute a planned upgrade to a patched WebLogic version if no patch becomes available within 30 days of this assessment.

Oracle WebLogic Server CVE-2026-60198

EUVD-2026-46604 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-4q45-xm9v-jj8c

Authentication Bypass Oracle Oracle Weblogic Server Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network exploitation over T3/IIOP with low complexity and no user interaction yielding full server takeover justifies AV:N/AC:L/PR:N/UI:N and C/I/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:04 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Complete server takeover in Oracle WebLogic Server (Fusion Middleware, Core component) is possible by unauthenticated attackers who reach the T3 or IIOP remoting protocols over the network. Oracle rates this 9.8 with full confidentiality, integrity, and availability impact and describes it as 'easily exploitable,' meaning any exposed T3/IIOP listener on affected 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0 builds can be commandeered without credentials. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the T3/IIOP attack surface has a long history of weaponized deserialization exploits, so patch urgency is high.

Technical ContextAI

WebLogic Server exposes proprietary remote-invocation protocols - T3 (its native RMI transport, default TCP 7001) and IIOP (CORBA interop) - used for clustering, JNDI lookups, and EJB calls. Historically, nearly every unauthenticated 'takeover' bug in the Core component of these versions has been a Java deserialization flaw, where a crafted T3/IIOP payload is deserialized by the server and drives a gadget chain to arbitrary code execution; Oracle's terse 'takeover via T3, IIOP' wording is consistent with that class. The CWE is not populated in this feed (CWE: N/A), so the exact root-cause class is not vendor-confirmed here, but the network vector plus these protocols point to unsafe deserialization / insecure remote object handling. The affected CPE is cpe:2.3:a:oracle_corporation:oracle_weblogic_server, a Java EE / Jakarta EE application server component of Oracle Fusion Middleware widely used to host enterprise Java applications.

RemediationAI

Apply the Oracle Critical Patch Update of July 2026 for the affected WebLogic release train (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0) per https://www.oracle.com/security-alerts/cpujul2026.html - Patch available per vendor advisory (Oracle CPU July 2026); apply the CPU bundle for your exact version. Because this feed does not include a discrete patched build string, confirm the precise patch/PSU number from the CPU advisory before deploying. As compensating controls until patched: restrict or disable external access to the T3 and IIOP protocols using WebLogic connection filters (weblogic.security.net.ConnectionFilterImpl) to allow T3/IIOP only from trusted management hosts; block TCP 7001 (and any custom T3/IIOP ports and SSL variants) at the network firewall from all untrusted sources; and place WebLogic admin/remoting interfaces behind a VPN or internal segment. Note trade-offs: tightening connection filters or blocking T3/IIOP can break WebLogic clustering, remote JNDI/EJB clients, and management tooling that legitimately use these protocols, so validate against your integration topology before enforcing.