What is the CVSS score of CVE-2026-60201?

CVE-2026-60201 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebLogic Server are affected by CVE-2026-60201?

Oracle WebLogic Server (Fusion Middleware) versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 are vulnerable to remote unauthenticated takeover; no public exploit identified at time of…

How to fix or mitigate CVE-2026-60201?

Within 24 hours, conduct a complete inventory of Oracle WebLogic Server deployments across the enterprise, identifying all instances running versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0, and categorize them by business criticality and network exposure. Within 7 days, implement network-level access controls to restrict T3 and IIOP protocol traffic to affected WebLogic instances from untrusted networks; deploy enhanced monitoring and alerting on these systems; and coordinate with infrastructure and change management teams to prioritize patching timelines. Within 30 days, continuously monitor Oracle Security Advisories for patch availability, prepare detailed deployment and rollback procedures for each affected environment, conduct pre-production testing of the patched versions, and execute phased patching beginning with lower-risk systems.

Oracle WebLogic Server CVE-2026-60201

EUVD-2026-46607 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-hhq4-53w6-w7v5

Authentication Bypass Oracle Oracle Weblogic Server Oracle Corporation

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Unauthenticated network attack over T3/IIOP (AV:N/PR:N/UI:N) yielding full takeover (C:H/I:H/A:H), but 'difficult to exploit' per Oracle justifies AC:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:03 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle WebLogic Server (Fusion Middleware, Core component) is possible by an unauthenticated attacker sending crafted traffic over the T3 or IIOP protocols against versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle rates it CVSS 3.1 8.1 with full confidentiality, integrity, and availability compromise, but flags high attack complexity (AC:H), meaning the flaw is difficult to exploit despite requiring no authentication. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so this is currently a patch-priority based on impact rather than confirmed exploitation.

Technical ContextAI

Oracle WebLogic Server is a Java EE application server at the core of Oracle Fusion Middleware, widely used to host enterprise Java applications. The vulnerability lives in the Core component and is reachable through T3 and IIOP - the proprietary RMI-style remoting protocols WebLogic exposes by default on its listen port to support clustering and remote object invocation. Historically, this exact attack surface has been the vector for a long line of WebLogic Java deserialization / remote-object flaws, where untrusted serialized objects delivered over T3/IIOP are processed by the server and lead to remote code execution and full host takeover. No CWE was assigned in the source data, but the T3/IIOP vector combined with a 'takeover' outcome is consistent with an unsafe-deserialization or remote-object-injection class of bug.

RemediationAI

Apply the Oracle Critical Patch Update of July 2026 for the affected WebLogic Server release train (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0) as the primary fix - Patch available per vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html; the input does not provide a discrete fixed build number, so consult the CPU matrix for the exact patch/PSU for your version. Because the vector is T3/IIOP, the key compensating control if you cannot patch immediately is to restrict these protocols: configure a WebLogic connection filter (weblogic.security.net.ConnectionFilterImpl) to allow T3/T3S/IIOP only from trusted management hosts, and block the WebLogic listen port (default 7001, or your configured port) from untrusted networks at the perimeter and internal firewalls. Trade-off: filtering or blocking T3/IIOP can break inter-cluster communication, remote JMX/administration, and remote EJB/JMS clients that legitimately use these protocols, so validate against your integration topology before enforcing.