What is the CVSS score of CVE-2026-60202?

CVE-2026-60202 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebLogic Server are affected by CVE-2026-60202?

A critical vulnerability in Oracle WebLogic Server (Fusion Middleware Core) enables unauthenticated remote attackers to achieve complete server compromise through T3 and IIOP network protocols,…

How to fix or mitigate CVE-2026-60202?

Within 24 hours, conduct a complete inventory of all Oracle WebLogic instances to identify those running versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0, and assess their network accessibility on T3 (port 7001) and IIOP (port 7002) protocols. Within 7 days, implement network-based compensating controls: restrict T3 and IIOP access via firewall rules to trusted internal networks only, disable these protocols at the application level if business operations permit, and deploy deep packet inspection or protocol-level monitoring to detect exploitation attempts. Within 30 days, monitor Oracle's security advisories for patch availability, develop and test an upgrade plan to move affected instances to patched versions when released, and begin staged rollout starting with non-production environments.

Oracle WebLogic Server CVE-2026-60202

EUVD-2026-46608 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-c6r7-3wc5-q688

Authentication Bypass Oracle Oracle Weblogic Server Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated (PR:N) network exploitation over T3/IIOP with no user interaction and low complexity, yielding full server takeover, so C/I/A all High.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:01 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Complete server takeover in Oracle WebLogic Server (Fusion Middleware Core component) lets an unauthenticated remote attacker fully compromise affected instances by sending crafted traffic over the T3 or IIOP protocols. It carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity, and availability impact and is described by Oracle as 'easily exploitable.' Supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 are affected; no public exploit identified at time of analysis and it is not currently listed in CISA KEV.

Technical ContextAI

Oracle WebLogic Server is a Java EE / Jakarta EE application server widely used to host enterprise middleware and web applications. The flaw resides in the Core component and is reachable through T3 (WebLogic's proprietary RMI wire protocol) and IIOP (CORBA over IIOP), both of which historically expose Java object handling and remote invocation surfaces. Although Oracle did not assign a CWE (listed as N/A) and the tags reference 'Information Disclosure,' the stated 'takeover' outcome with full C/I/A impact is consistent with the deserialization / remote-invocation class of bugs that has repeatedly affected WebLogic's T3 and IIOP listeners, where untrusted serialized data is processed before authentication.

RemediationAI

Apply the fixes from the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) for your specific WebLogic release (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0); the input does not include a single exact patched build number, so apply the CPU patch corresponding to your version as directed by the advisory (Patch available per vendor advisory). Because the attack vector is T3 and IIOP, the strongest compensating control until patching is to restrict or disable these protocols: use a WebLogic connection filter (weblogic.security.net.ConnectionFilterImpl) to allow T3/T3s and IIOP only from trusted management hosts, or disable IIOP in the server configuration if unused, and block external access to the T3/IIOP listen ports (default 7001) at the network/firewall layer. Trade-offs: filtering or disabling T3/IIOP can break WebLogic clustering, JMS clients, RMI/EJB remote clients, and admin tooling (e.g., WLST over T3), so validate management and inter-node traffic paths before enforcing.