What is the CVSS score of CVE-2026-60199?

CVE-2026-60199 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebLogic Server are affected by CVE-2026-60199?

Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 face critical risk from a remote unauthenticated takeover vulnerability (CVSS 9.8) in Fusion Middleware Core that…

How to fix or mitigate CVE-2026-60199?

Within 24 hours: conduct an inventory of all Oracle WebLogic Server instances across your environment, identify systems running versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0, and document network exposure and business criticality for each. Within 7 days: implement interim security controls including network segmentation to restrict WebLogic access to only essential internal systems, deploy WAF rules to inspect and block HTTP-based exploitation attempts on WebLogic ports, and enable enhanced audit logging with real-time alerting on suspicious connection patterns. Within 30 days: coordinate with application teams to test and plan migration to unaffected Oracle WebLogic versions, prioritizing internet-facing and production systems.

Oracle WebLogic Server CVE-2026-60199

EUVD-2026-46605 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-hqjw-2f5m-pw33

Authentication Bypass Oracle Oracle Weblogic Server Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Vendor describes unauthenticated network HTTP exploitation with no user interaction resulting in full server takeover, giving AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:03 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle WebLogic Server (Fusion Middleware Core component) allows an unauthenticated network attacker to fully compromise the server via HTTP, per Oracle's July 2026 Critical Patch Update. Affected releases are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, all carrying a maximum-severity CVSS 3.1 score of 9.8 with full confidentiality, integrity and availability impact. No public exploit identified at time of analysis, but WebLogic's history as a repeated exploitation target makes this a high-priority patch.

Technical ContextAI

Oracle WebLogic Server is a Java EE application server and a core component of the Oracle Fusion Middleware stack, widely used to host enterprise Java applications and expose administrative and application endpoints over HTTP/T3. The flaw resides in the 'Core' component and is reachable over the network via HTTP without authentication, a pattern historically associated with insecure deserialization of untrusted data in WebLogic's request-handling and IIOP/T3/HTTP dispatch paths. No CWE was assigned in the provided data, so the exact root-cause class cannot be confirmed; the single CPE (cpe:2.3:a:oracle_corporation:oracle_weblogic_server) confirms the affected product but is unversioned, so version scoping comes from the Oracle advisory text rather than structured CPE ranges.

RemediationAI

Apply Patch available per vendor advisory: install the fixes delivered in the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) for your specific release (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 or 15.1.1.0.0), as Oracle CPU bundles are the supported remediation path; no standalone fixed build number was provided in the input, so consult the advisory's patch matrix for the exact patch ID. Until patched, reduce exposure by restricting network access to the WebLogic administrative and application HTTP ports so they are not internet-facing (place behind a VPN or allowlist), and disable or firewall the T3/T3s and IIOP protocols if not required, since these have historically broadened the WebLogic attack surface - note this can break legacy clients and inter-server RMI calls that depend on T3/IIOP. Deploy a WAF or reverse proxy in front of WebLogic to filter anomalous HTTP requests as a detection/slowdown measure, understanding it is not a substitute for the vendor patch.