Oracle WebLogic Server CVE-2026-60204

The exploitable prerequisite is network reachability to the WebLogic Server listen port with the T3 or IIOP protocol accessible - both are enabled by default, so no special configuration is needed (AV:N/AC:L/PR:N/UI:N). No authentication and no user interaction are required against a default configuration of Oracle WebLogic Server. The primary limiting factor is network exposure: exploitation requires reaching the T3/IIOP port, so instances where those protocols are firewalled, filtered by a WebLogic connection filter, or disabled are not exposed. Only the supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 are stated as affected.

All available severity signals align: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H yields 9.8 - remote, low-complexity, unauthenticated exploitation with no user interaction and total impact to confidentiality, integrity, and availability. Oracle's own wording ('easily exploitable,' 'takeover') reinforces the CVSS reading. Two signals are absent and should only slightly temper prioritization: no EPSS score was provided, and the CVE is not currently in CISA KEV with no public POC identified, so this is not confirmed active exploitation. SSVC-style framing: exploitation = none observed yet, automatable = likely yes (network, unauthenticated, no UI over a commonly reachable protocol), technical impact = total. Note a data conflict: the 'Information Disclosure' tag understates the described full-takeover impact - treat the description and CVSS as authoritative over the tag. Net: a genuine top-priority patch item for any network- or internet-exposed WebLogic instance, not a high-CVSS-but-low-real-risk case, given WebLogic's history of fast exploitation of T3/IIOP takeover flaws.

An attacker who can reach a WebLogic listen port sends a crafted T3 or IIOP request carrying a malicious serialized Java payload; the Core component processes it without authentication and the attacker gains code execution and full control of the server. No credentials, user interaction, or non-default configuration are required, so a single network-reachable instance can be taken over directly. No public exploit is identified at time of analysis, but the attack requires no special preconditions.