What is the CVSS score of CVE-2026-60200?

CVE-2026-60200 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebLogic Server are affected by CVE-2026-60200?

Oracle WebLogic Server versions 12.2.1.4.0 through 15.1.1.0.0 are at critical risk of complete remote compromise by unauthenticated attackers, potentially affecting all business applications…

How to fix or mitigate CVE-2026-60200?

Within 24 hours: identify and inventory all systems running WebLogic versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0; map network exposure and dependent business applications; implement network-level access restrictions to SOAP endpoints from untrusted networks. Within 7 days: deploy Web Application Firewall rules to detect and block malformed SOAP requests; disable remote administrative access from the internet; enable comprehensive logging of all SOAP traffic and authentication attempts. Within 30 days: monitor Oracle's Critical Patch Update releases for the availability of patches; develop and test upgrade paths for each affected environment; apply vendor patches immediately upon release.

Oracle WebLogic Server CVE-2026-60200

EUVD-2026-46606 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-jm6v-c992-qpjv

Authentication Bypass Oracle Oracle Weblogic Server Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network SOAP request (AV:N/PR:N/UI:N) with low complexity yields full server takeover, so C:H/I:H/A:H; scope unchanged as compromise stays within the server.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:03 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SOAP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle WebLogic Server (Fusion Middleware Core component) allows an unauthenticated network attacker to fully compromise the server via a crafted SOAP request. Supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 are affected, and Oracle rates it easily exploitable with complete confidentiality, integrity, and availability impact (CVSS 9.8). No public exploit was identified at time of analysis, but given WebLogic's history as a mass-exploitation target, this warrants immediate patching from the July 2026 Critical Patch Update.

Technical ContextAI

Oracle WebLogic Server is a Java EE application server widely used to host enterprise web services and middleware. The flaw resides in the 'Core' component and is reached over the SOAP protocol, indicating the vulnerable code path is exposed through WebLogic's web-services/T3-adjacent SOAP handling layer. Oracle did not assign a CWE (listed as N/A), but the 'takeover' outcome combined with an unauthenticated SOAP entry point is consistent with WebLogic's well-documented pattern of insecure deserialization of untrusted Java objects delivered via SOAP/XML payloads, which historically yields remote code execution. The affected CPE is cpe:2.3:a:oracle_corporation:oracle_weblogic_server, spanning the 12.2.1.4, 14.1.1, 14.1.2, and 15.1.1 release lines.

RemediationAI

Patch available per vendor advisory: apply the fixes bundled in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) to each affected release line (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0); an exact patched build number was not provided in the input and should be taken directly from the CPU advisory matrix for your version. Because Oracle CPU patches require downtime, if you cannot patch immediately, apply compensating controls: restrict network access to the WebLogic administrative and web-services ports (e.g., 7001/7002 and any custom SOAP listener ports) so they are reachable only from trusted management networks, and place the server behind a filtering reverse proxy or WAF that blocks or inspects untrusted SOAP/XML POST requests to the Core web-services endpoints. As a stronger mitigation consistent with prior WebLogic guidance, disable or firewall the T3/IIOP and unused web-service subsystems if they are not required, noting the trade-off that this can break legacy client integrations and remote management tooling that rely on those protocols. These controls reduce exposure but are not a substitute for the CPU patch.