What is the CVSS score of CVE-2026-60291?

CVE-2026-60291 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebLogic Server are affected by CVE-2026-60291?

Oracle WebLogic Server instances running supported versions 12.2.1.4.0 through 15.1.1.0.0 are vulnerable to complete takeover by unauthenticated attackers with no available patches, creating…

How to fix or mitigate CVE-2026-60291?

Within 24 hours: Conduct a complete asset inventory identifying all WebLogic instances matching affected versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0), prioritize internet-facing deployments, and implement immediate network-level access restrictions limiting HTTP traffic to WebLogic Core components to known administrative networks only. Within 7 days: Deploy Web Application Firewall rules with signatures to detect exploitation attempts against the Core component, enable continuous packet-level monitoring for WebLogic traffic anomalies, establish 24/7 incident response readiness, and brief business stakeholders on operational constraints during the remediation window. Within 30 days: Execute a comprehensive remediation strategy including monitoring Oracle's Critical Patch Update schedule for vendor fixes, evaluating workload migration to unaffected application servers, implementing network isolation for vulnerable instances to air-gapped environments where business-critical, and stress-testing failover and disaster recovery procedures to ensure business continuity if exploitation occurs.

Oracle WebLogic Server CVE-2026-60291

EUVD-2026-46706 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-m45f-j92r-qrj9

Authentication Bypass Oracle Oracle Weblogic Server Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Description confirms remote unauthenticated HTTP exploitation with low complexity and no interaction resulting in full server takeover, so AV:N/AC:L/PR:N/UI:N and C/I/A all High.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:27 vuln.today

CVE Published

Jul 21, 2026 - 21:34 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Complete takeover of Oracle WebLogic Server is possible by unauthenticated remote attackers via HTTP against the Core component, affecting supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Disclosed in Oracle's July 2026 Critical Patch Update with a CVSS 3.1 base score of 9.8 (full confidentiality, integrity and availability impact), the flaw requires no privileges, no user interaction and low attack complexity. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but WebLogic's history as a mass-exploited middleware target makes rapid weaponization likely once details emerge.

Technical ContextAI

Oracle WebLogic Server is a Java EE application server within the Oracle Fusion Middleware stack, widely deployed to host enterprise Java web applications and services. The vulnerability resides in the 'Core' component and is reachable over HTTP, the same protocol WebLogic exposes for its management, console and application-serving interfaces. No CWE was assigned in the source data, so the precise root-cause class (historically WebLogic 'takeover' bugs have stemmed from insecure deserialization of untrusted data - CWE-502 - in T3/IIOP or HTTP handlers, or from authentication-bypass path traversal) cannot be confirmed from the provided intelligence. The single CPE, cpe:2.3:a:oracle_corporation:oracle_weblogic_server:*:*:*:*:*:*:*:*, confirms the affected product but does not itself constrain versions; the affected version list comes from the Oracle advisory text.

RemediationAI

Apply the fixes from Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) - Patch available per vendor advisory; the exact patched build for each of 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 must be taken from that CPU matrix, as no discrete fixed version string was provided in this intelligence and none should be invented. Until patching completes, reduce exposure by restricting network access to WebLogic HTTP and administration ports (default 7001/7002) so they are not reachable from untrusted networks, and place the server behind a reverse proxy or WAF that filters anomalous requests to the Core/console paths; because prior WebLogic takeover bugs abused deserialization endpoints, consider disabling or firewalling the T3/IIOP and remote console interfaces if not required, accepting the trade-off that remote administration and some clustering functions may break. These are compensating controls only - the CPU patch is the sole complete fix.