What is the CVSS score of CVE-2026-60207?

CVE-2026-60207 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebLogic Server are affected by CVE-2026-60207?

Oracle WebLogic Server versions 12.2.1.4.0 and 14.1.2.0.0 contain a high-severity vulnerability (CVSS 8.8) enabling full server takeover following low-privilege authentication.

How to fix or mitigate CVE-2026-60207?

Within 24 hours, audit your infrastructure to identify and document all Oracle WebLogic Server instances running versions 12.2.1.4.0 or 14.1.2.0.0, with priority to production and business-critical systems. Within 7 days, implement network-layer access controls restricting HTTP traffic to affected WebLogic Server instances to authorized administrative IP ranges only, and enable comprehensive monitoring and audit logging of all authentication events and administrative activities on these systems; concurrently, contact Oracle support to confirm patch status and expected availability timeline. Within 30 days, deploy any released security patches to all affected instances as soon as they are available from Oracle, prioritizing production systems, or evaluate migration to patched versions of Oracle WebLogic Server.

Oracle WebLogic Server CVE-2026-60207

EUVD-2026-46613 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-92v6-hg99-rrh7

Authentication Bypass Oracle Oracle Weblogic Server Oracle Corporation

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network HTTP reachable with low complexity and no user interaction, but a low-privilege authenticated foothold is required (PR:L), and full takeover yields C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:59 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full server takeover in Oracle WebLogic Server (Fusion Middleware Core component) versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with network HTTP access to fully compromise confidentiality, integrity, and availability of the server. Rated CVSS 3.1 8.8 (High) and disclosed in Oracle's July 2026 Critical Patch Update, the flaw requires only low-level authenticated access and no user interaction, making it attractive for post-authentication lateral movement. No public exploit identified at time of analysis, and it is not currently listed in CISA KEV.

Technical ContextAI

Oracle WebLogic Server is a Java EE application server at the heart of many Oracle Fusion Middleware deployments, exposing HTTP(S), T3, and IIOP listeners. The vulnerability resides in the WebLogic 'Core' subsystem, which handles request processing and management functions shared across deployed applications. Oracle did not assign a CWE (CWE: N/A) and provides no technical root-cause detail in its advisory; the 'Information Disclosure' tag combined with the C:H/I:H/A:H impact and 'takeover' language suggests an authenticated flaw that escalates from limited access to complete server control, a pattern historically associated with insecure deserialization or authorization bypass in WebLogic. The affected CPE is cpe:2.3:a:oracle_corporation:oracle_weblogic_server, covering the 12.2.1.4.0 and 14.1.2.0.0 release lines.

RemediationAI

Apply the patches from Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the authoritative source for the exact patch/bundle numbers for the 12.2.1.4.0 and 14.1.2.0.0 lines - Patch available per vendor advisory; a specific fixed build string was not included in the provided data and should be taken directly from the CPU matrix. Because exploitation requires low-privileged authenticated HTTP access, meaningful compensating controls until patching include restricting network reachability of the WebLogic admin and managed-server HTTP ports to trusted management networks only (trade-off: may disrupt legitimate remote administration and app traffic), enforcing strong authentication and pruning unnecessary low-privilege accounts to shrink the pool of usable footholds, and placing a WAF or reverse proxy in front of the HTTP listeners to filter anomalous requests (trade-off: signature coverage is uncertain without exploit details). Do not rely on workarounds as a substitute for the Oracle CPU patch.