Oracle WebLogic Server CVE-2026-60201

Exploitation requires network access to Oracle WebLogic Server's T3 or IIOP listener (typically the default listen port 7001/7002) - these protocols must be reachable from the attacker, which is the default on an internet- or network-exposed WebLogic deployment. No authentication is needed (PR:N) and no user interaction is required (UI:N). The principal limiting factor is high attack complexity (AC:H): Oracle labels this 'difficult to exploit,' indicating the attack depends on conditions beyond the attacker's direct control (e.g., specific timing, memory state, or environmental factors), which reduces reliability. Deployments that have already restricted T3/IIOP via WebLogic connection filters or firewall rules, or that do not expose the listen port to untrusted networks, materially limit exposure. Only the listed supported versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) are stated as affected.

The CVSS 3.1 base score is 8.1 (High), driven by network reachability (AV:N), no privileges (PR:N), no user interaction (UI:N), and full C/I/A impact, but tempered by high attack complexity (AC:H) - Oracle explicitly calls it 'difficult to exploit,' which typically means additional conditions, timing, or configuration are required to land the attack. No EPSS score, POC, or KEV status was provided in the input, so exploitation probability cannot be quantified from the data; there is no public exploit identified at time of analysis and no evidence of active exploitation. The realistic priority is elevated rather than emergency: the unauthenticated network vector and total-takeover impact make it a must-patch, but AC:H and the absence of a known exploit suggest it is not (yet) mass-exploitable. Note the source tags label this 'Information Disclosure' while the description and CVSS (C:H/I:H/A:H, 'takeover') indicate full compromise - the tag understates the impact and should be disregarded in favor of the CVSS vector and description.

An attacker with only network reachability to the WebLogic listen port sends a crafted T3 or IIOP request carrying a malicious remote object/payload to the Core component; after satisfying the more demanding exploitation conditions (AC:H), the server processes it and the attacker gains control of the WebLogic instance. No credentials and no user interaction are required, and the result is full server takeover. No public exploit is identified at time of analysis, so this scenario reflects the described capability rather than an observed campaign.