Oracle WebLogic Server CVE-2026-60199

No special conditions - remote unauthenticated exploitation against default network-exposed configurations of Oracle WebLogic Server, requiring only HTTP reachability to the server (CVSS AV:N/AC:L/PR:N/UI:N). The practical limiting factor is network exposure: exploitation requires the attacker to reach a WebLogic HTTP listener, so instances confined to trusted internal segments, behind a VPN, or with the admin/application ports firewalled are substantially harder to reach. Only the enumerated supported versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) are stated as affected; no authentication, specific feature toggle, or non-default setting is required per the vendor description.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H yields 9.8 and describes the worst realistic profile: network-reachable, low complexity, no privileges, no user interaction, with total impact to confidentiality, integrity and availability - Oracle explicitly states this results in full 'takeover' of the server. All signals point in the same direction with no conflicts between the CVSS vector and the description (both indicate unauthenticated remote HTTP exploitation). No EPSS score, KEV status, or SSVC decision data was provided, so exploitation probability cannot be quantified from the input; however, WebLogic is a perennial mass-exploitation target and unauthenticated RCE-class flaws in it are routinely weaponized shortly after disclosure. This should be treated as a genuine top-priority patch rather than a high-CVSS-but-low-real-risk issue, with the caveat that active-exploitation and POC signals are simply absent from the data, not confirmed negative.

An attacker who can reach a WebLogic HTTP endpoint sends a single crafted, unauthenticated HTTP request to the vulnerable Core component and, because no privileges or user interaction are required, gains full control of the server. From there the attacker can execute code, exfiltrate data, deploy web shells or ransomware, and pivot into the internal network. No public POC is identified in the provided data, but the low attack complexity makes reliable exploitation likely once technical details circulate.