Oracle WebLogic Server CVE-2026-60207

Exploitation requires network access to the WebLogic Server HTTP interface plus valid low-privilege credentials or an authenticated session (CVSS PR:L), and targets the Core component of versions 12.2.1.4.0 and 14.1.2.0.0. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once authenticated access is held the attack is straightforward and repeatable. The primary limiting factors are the authentication requirement (not exploitable by a fully anonymous attacker) and version scope (only the two named release lines are confirmed affected); Oracle's advisory does not specify a non-default configuration prerequisite, implying default deployments of the affected versions are exposed to any low-privileged user.

The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates a network-reachable, low-complexity attack requiring only low privileges and no user interaction, yielding total system compromise - a genuinely high-priority profile for internet- or intranet-exposed WebLogic instances. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so real-world exploitation likelihood cannot be quantified from the input; the absence of KEV means there is no confirmed active exploitation at this time. The key limiting factor is the PR:L requirement: an attacker must already hold some authenticated foothold (valid low-privilege credentials or session), so this is more a privilege-escalation-to-takeover risk than a pure unauthenticated internet worm. Given WebLogic's history as a frequent exploitation target, defenders should treat this as urgent-to-patch despite the missing exploitation telemetry. Note: EPSS and KEV data are absent from the input and were not independently verified.

An attacker who has obtained a low-privilege WebLogic account or session - for example via phishing, credential stuffing, or a compromised application user - sends a crafted HTTP request to the WebLogic Core component and abuses the flaw to escalate to full server control. Because attack complexity is low and no user interaction is needed, the request can be scripted and repeated reliably once valid low-level access exists. No public exploit is identified at this time, so real-world attacks would currently require an attacker to develop their own exploit.