Oracle WebLogic Server CVE-2026-60293

Exploitation requires only network access to an exposed Oracle WebLogic Server WLS Web Services endpoint over HTTP; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there are no authentication, user-interaction, or special-configuration prerequisites, so default deployments with reachable web-service endpoints are exploitable. The practical limiting factors are therefore network exposure of the web-services ports/context paths and running one of the affected versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0); instances where the Web Services component is undeployed or the endpoints are unreachable from the attacker's network are not exposed. Impact is confined to confidentiality (data disclosure) - integrity and availability are not affected.

The signals point to a genuine high priority rather than a paper-high score: the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N combines network reachability, low complexity, no privileges and no user interaction, meaning any exposed WebLogic web-service endpoint is trivially reachable, and the scope change (S:C) plus confirmed high confidentiality impact means a compromise can reach data in other connected products. The offsetting factor is that impact is confidentiality-only (I:N/A:N) - this is a data-exposure/authentication-bypass issue, not remote code execution or denial-of-service. No EPSS score, KEV listing, or POC was provided, so exploitation probability cannot be quantified and there is no evidence of active exploitation; however, WebLogic is a perennial, heavily targeted attacker favorite, so weaponization historically follows Critical Patch Update disclosure quickly. The 'Authentication Bypass' tag aligns with PR:N in the vector, so the available signals are internally consistent.

An attacker who can reach a WebLogic web-service endpoint over HTTP sends a crafted request to the WLS Web Services component without any credentials, bypassing authentication to read sensitive data the server can access. Because of the scope change, the attacker may reach critical data belonging to other products integrated with the WebLogic instance. No public exploit is identified at time of analysis, but the low attack complexity makes reliable exploitation likely once technical details emerge.