Oracle Weblogic Server CVE-2026-60292

Oracle WebLogic Server versions 12.2.1.4.0 and 14.1.1.0.0 are vulnerable to complete unauthenticated remote takeover via crafted HTTP requests to the Core component. Though no public exploit has been identified at time of analysis, the severity is extreme due to complete infrastructure compromise risk and absence of available patches. Organizations running these specific versions face critical risk and must immediately implement interim protective controls.

Within 24 hours, inventory all WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 instances across production and non-production environments and implement strict firewall rules restricting access to WebLogic administrative ports (7001, 7002) to authorized internal systems only. Within 7 days, deploy WAF/IDS signatures targeting exploitation attempts against the Core component and establish enhanced monitoring with real-time alerting for suspicious HTTP traffic to these systems. Within 30 days, develop and begin testing an upgrade path to patched WebLogic versions, or harden compensating controls if immediate migration is not feasible.

Restrict WebLogic port access to authorized systems via firewall rules; deploy WAF/IDS signatures targeting Core component exploitation patterns; enable comprehensive HTTP logging and real-time alerting for administrative access and anomalous traffic; disable unnecessary administrative features. No vendor-released patch identified at time of analysis; interim controls provide protection until patches become available.