What is the CVSS score of CVE-2026-60204?

CVE-2026-60204 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebLogic Server are affected by CVE-2026-60204?

Oracle WebLogic Server versions 12.2.1.4.0 through 15.1.1.0.0 are vulnerable to unauthenticated remote takeover via T3 and IIOP protocol exploitation, allowing attackers to achieve complete system…

How to fix or mitigate CVE-2026-60204?

Within 24 hours, conduct an inventory of all Oracle WebLogic deployments and identify any running affected versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0); immediately isolate any internet-exposed instances or restrict T3/IIOP protocol access via network segmentation and firewall rules. Within 7 days, deploy compensating controls including WAF/IPS rules to block T3/IIOP protocol exploitation attempts, disable T3 and IIOP protocols if operationally feasible, and implement enhanced monitoring for anomalous T3/IIOP traffic and command execution; establish daily checks of Oracle security advisories for patch availability. Within 30 days, develop an upgrade plan to transition affected instances to patched versions once Oracle releases fixes, and conduct a post-remediation security assessment to confirm effective control deployment.

Oracle WebLogic Server CVE-2026-60204

EUVD-2026-46610 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-hg6v-vh44-p6vp

Authentication Bypass Oracle Oracle Weblogic Server Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated, low-complexity network exploitation over default-enabled T3/IIOP with no user interaction gives PR:N/AC:L/AV:N, and full server takeover gives C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:01 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle WebLogic Server (Fusion Middleware, Core component) lets an unauthenticated network attacker fully compromise the server by sending crafted requests over the T3 or IIOP protocols. Oracle rates this 9.8 with full confidentiality, integrity, and availability impact and calls it 'easily exploitable,' affecting supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. No public exploit is identified at time of analysis and it is not in CISA KEV, but this class of unauthenticated T3/IIOP takeover has historically been rapidly weaponized in WebLogic.

Technical ContextAI

WebLogic Server is Oracle's Java EE/Jakarta EE application server and a core piece of Oracle Fusion Middleware, widely used to host enterprise Java applications. The flaw resides in the Core component and is reached through T3 (WebLogic's proprietary RMI-based remote protocol) and IIOP (the CORBA Internet Inter-ORB Protocol), both enabled by default on the WebLogic listen port and both carriers of serialized Java objects. Oracle assigned no CWE (CWE: N/A), but takeover-class WebLogic bugs reachable via T3/IIOP have historically been Java deserialization of untrusted data (CWE-502), where a malicious serialized object deserialized by the server drives arbitrary code execution; that is the most probable mechanism here though not confirmed by the provided data. The CPE cpe:2.3:a:oracle_corporation:oracle_weblogic_server:*:*:*:*:*:*:*:* covers the product generically, with the exact affected releases enumerated in the description.

RemediationAI

Apply the fixes from the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) to each affected release (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) - Patch available per vendor advisory; Oracle CPUs ship as patch bundles rather than a single version string, so pull the specific patch for your installed version. Until patched, reduce the T3/IIOP attack surface: restrict or disable the T3 and IIOP protocols on the WebLogic listen ports and configure a WebLogic connection filter (weblogic.security.net.ConnectionFilterImpl) to allow T3/IIOP only from trusted management hosts, accepting that this can break inter-domain clustering, remote JMX/WLST administration, and legacy IIOP clients. Additionally, place WebLogic behind a firewall so the administration/listen port is never internet-reachable and terminate application traffic through a reverse proxy that does not forward T3/IIOP. These are compensating controls only - the CPU patch is the authoritative fix.