Oracle WebLogic Server CVE-2026-60205

No special conditions - remote unauthenticated exploitation against default configurations of Oracle WebLogic Server, requiring only TCP network reachability to the affected server (CVSS AV:N/AC:L/PR:N/UI:N). The concrete prerequisite is network access to a listening WebLogic port, which in practice means the T3/T3s or IIOP remoting listeners (or the HTTP listener) being reachable from the attacker. Exploitation is limited only to the two named supported versions, 12.2.1.4.0 and 14.1.2.0.0; the main realistic mitigating factor is network exposure, so servers whose remoting ports are firewalled off from untrusted networks are substantially harder to reach even though the vulnerability itself needs no authentication, non-default configuration, or user interaction.

All available severity signals point to top-tier risk: the CVSS 3.1 vector is fully maximal for an unscoped compromise (AV:N network, AC:L low complexity, PR:N no privileges, UI:N no interaction, C/I/A all High), meaning trivially automatable remote takeover with no authentication. No EPSS score, SSVC decision, KEV entry, or POC was supplied in the input, so the exploitation-probability and in-the-wild signals cannot be quantified here - this is a genuine data gap, not a low-risk indicator. The absence of KEV/POC data should not be read as safety: WebLogic is a perennial target and previous unauthenticated Core RCEs (e.g., prior T3/IIOP deserialization CVEs) were weaponized within days of Oracle CPU disclosure. Weighing the maximal CVSS and product exploitation history against the missing EPSS/KEV telemetry, this is a real priority-one patching item rather than a high-CVSS-but-low-real-risk issue, though defenders should confirm current EPSS/KEV status independently as those feeds update.

An attacker who can reach an exposed WebLogic Server port over the internet or an adjacent network sends a crafted request to the vulnerable Core remoting endpoint without needing any credentials or user interaction. Because the flaw grants full takeover, the attacker gains code execution or equivalent control over the server, then uses it to deploy webshells, exfiltrate data, or pivot into the internal Fusion Middleware environment. No public exploit was identified at time of analysis, but the low attack complexity means reliable exploitation is expected once details circulate.