What is the CVSS score of CVE-2026-60205?

CVE-2026-60205 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebLogic Server are affected by CVE-2026-60205?

A critical security gap in Oracle WebLogic Server versions 12.2.1.4.0 and 14.1.2.0.0 allows remote attackers to take complete control of affected systems without any login credentials, posing…

How to fix or mitigate CVE-2026-60205?

Within 24 hours: Inventory all Oracle WebLogic deployments to identify systems running versions 12.2.1.4.0 or 14.1.2.0.0, and assess network exposure of affected instances. Within 7 days: Implement network segmentation to restrict access to WebLogic infrastructure, deploy Web Application Firewall rules blocking suspicious administrative traffic, enable comprehensive audit logging for detection, and establish incident response procedures specific to this vulnerability. Within 30 days: Execute upgrade path to patched WebLogic versions when released by Oracle, or complete migration to alternative platforms if WebLogic is planned for sunset; validate patched versions against your application stack prior to production deployment.

Oracle WebLogic Server CVE-2026-60205

EUVD-2026-46611 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-p664-7m6w-5c4c

Authentication Bypass Oracle Oracle Weblogic Server Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle confirms unauthenticated remote takeover over TCP with no user interaction, so AV:N/AC:L/PR:N/UI:N and full C:H/I:H/A:H; scope unchanged per Oracle's stated S:U.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:00 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full server takeover in Oracle WebLogic Server (Fusion Middleware Core component) affects supported versions 12.2.1.4.0 and 14.1.2.0.0, allowing a remote unauthenticated attacker with only TCP network access to fully compromise the server. The maximum-severity CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) reflects that successful exploitation yields complete confidentiality, integrity, and availability compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but WebLogic's history as a mass-exploited target makes this a high-priority patch.

Technical ContextAI

Oracle WebLogic Server is a Java EE application server that is a core runtime within Oracle Fusion Middleware, commonly exposed via the T3/T3s and IIOP remoting protocols as well as HTTP. The flaw resides in the 'Core' component, which historically has been the locus of deserialization-based remote code execution issues in WebLogic (the product line has repeatedly suffered from unsafe Java object deserialization over T3/IIOP). Oracle did not assign a CWE (listed as N/A) and does not disclose root-cause detail in Critical Patch Update advisories, but the 'network access via TCP' phrasing and unauthenticated takeover outcome are consistent with the deserialization/remote-protocol attack surface that WebLogic's Core exposes. The single affected CPE, cpe:2.3:a:oracle_corporation:oracle_weblogic_server, confirms the scope is the WebLogic Server product itself rather than a bundled library.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 for the affected releases 12.2.1.4.0 and 14.1.2.0.0, per the vendor advisory (patch available per Oracle CPU) at https://www.oracle.com/security-alerts/cpujul2026.html; Oracle CPUs bundle the patched builds rather than publishing a standalone tagged version, so download the CPU patch matching your exact WebLogic version from My Oracle Support. Until patching is complete, reduce exposure by restricting network reachability of the WebLogic remoting ports (notably the T3/T3s and IIOP listeners) to trusted management networks via firewall rules, which blocks the primary unauthenticated TCP attack surface at the cost of breaking legitimate remote T3/IIOP clients. Where feasible, apply WebLogic's connection filter (weblogic.security.net.ConnectionFilterImpl) to allowlist T3/IIOP source addresses, and disable IIOP if it is not required, understanding this may impact EJB/CORBA interoperability. Place the admin and managed server ports behind a reverse proxy or VPN and monitor for anomalous T3/IIOP traffic as a compensating detection control.