What is the CVSS score of CVE-2026-60208?

CVE-2026-60208 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebLogic Server are affected by CVE-2026-60208?

Oracle WebLogic Server (Fusion Middleware Core) contains a critical unauthenticated authentication bypass (CVE-2026-60208, CVSS 9.1) allowing remote attackers to read, modify, and delete data without…

How to fix or mitigate CVE-2026-60208?

Within 24 hours: Immediately identify and inventory all Oracle WebLogic Server instances across versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 that are internet-facing or accessible from untrusted networks, then implement emergency network segmentation to restrict HTTP/HTTPS access to WebLogic administrative ports (default 7001, 7002) to known trusted IP ranges only. Within 7 days: Deploy continuous monitoring and logging on all affected WebLogic instances to detect exploitation attempts, establish daily threat intelligence monitoring for exploit availability, and escalate a support request with Oracle to obtain patch timelines and interim guidance. Within 30 days: Apply the vendor-released patch immediately upon availability from Oracle's advisory updates, or execute application migration to patched WebLogic versions; maintain strict network isolation for any systems that cannot be patched within this window.

Oracle WebLogic Server CVE-2026-60208

EUVD-2026-46614 CRITICAL

Uncontrolled Resource Consumption (CWE-400)

2026-07-21 oracle

GHSA-jpjp-wq38-65mq

Authentication Bypass Denial Of Service Oracle Oracle Weblogic Server Oracle Corporation

9.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

9.1 CRITICAL

Unauthenticated remote HTTP exploitation with no user interaction gives AV:N/AC:L/PR:N/UI:N; full data read/write yields C:H/I:H, with no service disruption so A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:59 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

CRITICAL 9.1

DescriptionCVE.org

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebLogic Server accessible data as well as unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Remote unauthenticated compromise of Oracle WebLogic Server (Fusion Middleware Core component) lets network attackers read, create, delete, or modify any server-accessible data over HTTP. Tagged as an authentication bypass and scored CVSS 3.1 9.1, it affects supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 and was disclosed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the trivial exploitability (AC:L/PR:N/UI:N) makes it a high-priority patch for internet-facing deployments.

Technical ContextAI

Oracle WebLogic Server is a Java EE/Jakarta EE application server that is a core runtime for Oracle Fusion Middleware and a common backend for enterprise web and integration workloads. The flaw resides in the Core component and is classified in the intelligence tags as an Authentication Bypass, meaning an attacker can reach privileged functionality without valid credentials - historically WebLogic Core/authentication issues have stemmed from insecure deserialization, IIOP/T3 protocol handling, or request-routing/authorization filter bypasses, though Oracle does not publish an exact CWE for this entry (CWE listed as N/A). The single CPE, cpe:2.3:a:oracle_corporation:oracle_weblogic_server, confirms the affected surface is the WebLogic Server product itself rather than a bundled library. Because exploitation is over HTTP against the network-facing management/application interfaces, any WebLogic instance whose HTTP listener is reachable is within scope.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html); patch available per vendor advisory - Oracle ships these as version-specific Patch Set Updates/bundle patches for 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, so select the CPU bundle matching your exact release rather than an invented version number. Until patched, reduce exposure by removing the WebLogic HTTP/administration listeners from the public internet and restricting access to trusted management networks or a VPN, and place the server behind a WAF or reverse proxy that can filter anomalous requests to the affected endpoints; note that network restrictions may break legitimate remote administration or federated integrations, and WAF rules for an undisclosed vector are only a partial, signature-dependent stopgap. Because the issue is an authentication bypass in the Core component, disabling optional application features is unlikely to fully close it - prioritize the vendor patch.