What is the CVSS score of CVE-2026-60203?

CVE-2026-60203 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebLogic Server are affected by CVE-2026-60203?

Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 are vulnerable to remote server takeover by low-privileged attackers with HTTP access, enabling full system…

How to fix or mitigate CVE-2026-60203?

Within 24 hours: Identify and inventory all Oracle WebLogic Server instances running versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, assess their network exposure and criticality level, and document current access control configurations. Within 7 days: Implement network segmentation to restrict HTTP access to WebLogic servers to authorized networks only, deploy web application firewall (WAF) rules to detect and block exploitation attempts, enable enhanced audit logging for all administrative activity, rotate all WebLogic administrative credentials, and establish alerting for suspicious access patterns. Within 30 days: Monitor Oracle's security advisories for patch availability; prepare and test an upgrade plan to migrate affected instances to patched versions with priority to production systems; evaluate temporary disabling or air-gapping of non-critical WebLogic instances; and conduct full vulnerability reassessment once patches are released and applied.

Oracle WebLogic Server CVE-2026-60203

EUVD-2026-46609 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-rqw7-95r3-7jq6

Authentication Bypass Oracle Oracle Weblogic Server Oracle Corporation

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network HTTP vector with low complexity and no user interaction, but low-privilege access is required (PR:L); full server takeover gives high C/I/A within an unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:01 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Server takeover in Oracle WebLogic Server (Fusion Middleware Core component) allows a low-privileged, remote attacker with HTTP network access to fully compromise the server, per the Oracle July 2026 Critical Patch Update. Affected versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, and Oracle rates the flaw 'easily exploitable' with high confidentiality, integrity and availability impact (CVSS 3.1 8.8). No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and authenticated-network vector make it a high-priority patch item.

Technical ContextAI

Oracle WebLogic Server is a Java EE / Jakarta EE application server widely used as the runtime backbone for Oracle Fusion Middleware and custom enterprise Java applications. The vulnerability resides in the 'Core' subsystem, the component that handles request processing, remoting, and internal service dispatch, and is reachable over HTTP. Oracle does not assign a CWE for this issue (CWE: N/A) and does not disclose the mechanism, but historically WebLogic Core takeover flaws stem from unsafe deserialization of untrusted data (CWE-502) or authorization/logic bypass in remote endpoints; the single affected CPE is cpe:2.3:a:oracle_corporation:oracle_weblogic_server. Because the CVSS vector is Scope: Unchanged with full CIA impact, code execution occurs within the WebLogic server's own security context rather than crossing into a separate component.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html), which is the authoritative source for the exact patch bundle per WebLogic release; Oracle ships this as CPU patches rather than a single tagged version number, so map your installed release (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 or 15.1.1.0.0) to the corresponding July 2026 CPU patch. Because exploitation requires HTTP network reach with low privileges, effective compensating controls until patching include restricting network access to the WebLogic admin and application HTTP/T3 ports to trusted management networks, placing the server behind a WAF or reverse proxy that filters anomalous requests, tightening and auditing low-privilege application accounts to reduce the pool of usable credentials, and where WebLogic offers a filtering mechanism, enabling a strict deserialization/connection filter; note these controls reduce but do not eliminate risk and network restrictions may break legitimate remote integrations. Patch status: patch available per vendor advisory (Oracle July 2026 CPU).