Oracle WebLogic Server CVE-2026-60200

Exploitation requires network access to an Oracle WebLogic Server instance whose SOAP/web-services interface (Core component) is reachable by the attacker - this is the exact protocol named in the description. No authentication is required (CVSS PR:N confirms unauthenticated) and no user interaction is needed (UI:N), so any default deployment exposing the SOAP listener to the attacker's network is exploitable. The primary limiting factor is network reachability of the SOAP endpoint: instances whose management/web-services ports are firewalled off from untrusted networks are not remotely exploitable. Affected versions are limited to 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0; other/unsupported versions were not assessed in the source data.

This is a genuine high-priority issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) reflects the worst practical profile: network-reachable, low complexity, no privileges, no user interaction, and full CIA impact - Oracle explicitly describes it as 'easily exploitable' resulting in server takeover. EPSS was not provided in the input, and there is no CISA KEV listing or public POC referenced, so there is no confirmation of active exploitation yet; the risk case rests on the CVSS profile plus WebLogic's strong historical track record of being weaponized rapidly after Oracle CPU disclosures. The one signal to reconcile is the 'Information Disclosure' tag, which understates the impact - the description and CVSS clearly indicate full compromise (I:H/A:H), not mere disclosure, so treat the tag as incomplete metadata rather than a scope limiter. Absent EPSS/KEV data, the recommendation is to treat this as critical based on exploitability and prevalence rather than on confirmed in-the-wild activity.

An attacker with only network reachability to the WebLogic SOAP interface sends a single crafted SOAP request to the exposed Core endpoint, requiring no credentials and no user interaction. The malicious payload triggers the server-side flaw and results in full takeover of the WebLogic instance, letting the attacker execute commands and access all hosted applications and data. No public exploit was identified at time of analysis, but the low attack complexity makes reliable exploitation feasible once details are reverse-engineered from the patch.