Oracle WebLogic Server CVE-2026-60202

Exploitation requires network access to the WebLogic server's T3 (default listen port 7001/7002) or IIOP protocol endpoints - these listeners are enabled by default in standard WebLogic deployments. No authentication is required (PR:N), no user interaction is required (UI:N), and attack complexity is low (AC:L), so the primary limiting factor is network exposure of the T3/IIOP ports: organizations that already firewall or filter these proprietary protocols from untrusted networks substantially reduce reachability. Realistic risk is highest for internet-facing or broadly network-accessible WebLogic instances on the affected versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0).

This is a genuine top-priority vulnerability, not a high-score-but-low-risk case. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms network-reachable, low-complexity, unauthenticated exploitation with no user interaction, and Oracle explicitly calls it 'easily exploitable' resulting in full server takeover. No EPSS score, KEV listing, POC, or SSVC decision data was provided in the input, so exploitation-in-the-wild cannot be confirmed and probability cannot be quantified - however, WebLogic T3/IIOP flaws of this profile are historically rapid targets for mass exploitation once details or PoCs appear. The main mismatch to note: the tag 'Information Disclosure' understates the impact, since the description and vector indicate full compromise (C:H/I:H/A:H), so defenders should treat this as RCE-equivalent rather than mere information disclosure.

An attacker with network reachability to a WebLogic server's T3 or IIOP listener (typically port 7001) sends a crafted request that abuses the Core component's remote object handling, requiring no credentials and no user interaction. Given the low attack complexity, this yields remote code execution and full takeover of the server. No public exploit is identified at time of analysis, but the low-complexity unauthenticated profile makes weaponization straightforward once technical details circulate.