Oracle WebLogic Server CVE-2026-60203

Exploitation requires network access to the Oracle WebLogic Server over HTTP and a low level of privilege (CVSS PR:L) - meaning the attacker must be authenticated or otherwise hold a low-privileged account/session rather than being fully anonymous. No user interaction is needed (UI:N) and attack complexity is low (AC:L), and Oracle states the flaw is 'easily exploitable' against the Core component. Limiting factors that reduce realistic exposure: the requirement for some valid low-privilege access narrows the attacker set compared with a pre-auth flaw, and only supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 are named as affected. The specific configuration or feature that must be present is not disclosed in the Oracle advisory data provided.

The signals converge on genuine priority rather than an inflated CVSS. The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N (network, low complexity, low privilege, no user interaction) combined with Oracle's explicit 'easily exploitable' language and 'takeover' outcome indicates a reliable, repeatable exploit path. The one mitigating factor is PR:L - an attacker needs some level of authenticated or low-privileged access, which distinguishes this from a fully unauthenticated pre-auth RCE and slightly narrows the exposure to environments where attackers can obtain low-privilege credentials or where WebLogic is internet-facing with weak account controls. Countervailing data is limited: no EPSS score, KEV status, POC, or SSVC decision was supplied, so exploitation probability cannot be quantified and there is currently no evidence of active exploitation. WebLogic is a historically heavily-targeted product with a track record of rapid exploit weaponization after Oracle CPUs, so the absence of a POC today should not be read as durable safety - treat as high priority and patch on the next available window.

An attacker who holds a low-privileged WebLogic account - or who reaches an exposed WebLogic HTTP endpoint on a poorly segmented network - sends a crafted HTTP request to the Core component and, thanks to the low attack complexity, reliably triggers full server takeover with confidentiality, integrity, and availability impact. No user interaction is required and the attack executes within the server's security context. No public exploit code has been identified at time of analysis, but Oracle's 'easily exploitable' rating implies a straightforward path to weaponization.