What is the CVSS score of CVE-2026-60293?

CVE-2026-60293 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebLogic Server are affected by CVE-2026-60293?

A critical Oracle WebLogic Server vulnerability allows unauthenticated remote attackers to exfiltrate all data accessible to the server, affecting enterprise middleware deployments globally.

How to fix or mitigate CVE-2026-60293?

Within 24 hours, identify all WebLogic Server instances in your environment and verify whether any run affected versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0); immediately implement network-level HTTP access restrictions to vulnerable servers and deploy WAF rules to block exploitation attempts. Within 7 days, complete inventory of affected deployments, document all downstream systems and applications dependent on these WebLogic servers, and enable enhanced logging and alerting for unauthorized data access. Within 30 days, monitor Oracle's security advisories for patch availability and test the fix in non-production environments; prioritize production deployment of the patch to the most sensitive systems once released.

Oracle WebLogic Server CVE-2026-60293

EUVD-2026-46708 HIGH

Information Exposure (CWE-200)

2026-07-21 oracle

GHSA-4p6j-5j8j-4f72

Authentication Bypass Information Disclosure Oracle Oracle Weblogic Server Oracle Corporation

8.6

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

8.6 HIGH

Unauthenticated HTTP-reachable web-service endpoint gives AV:N/AC:L/PR:N/UI:N; scope change with data disclosure reaching other products and confidentiality-only impact yields S:C, C:H, I:N, A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:26 vuln.today

CVE Published

Jul 21, 2026 - 21:34 nvd

HIGH 8.6

DescriptionCVE.org

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS - Web Services). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. While the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).

AnalysisAI

Unauthorized data disclosure in Oracle WebLogic Server (WLS Web Services component) lets an unauthenticated remote attacker read all data accessible to the server over HTTP, with a scope change that can significantly impact additional products beyond WebLogic itself. Affected supported versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, addressed in Oracle's July 2026 Critical Patch Update. Rated CVSS 3.1 8.6 (confidentiality-only) and tagged as an authentication bypass; no public exploit identified at time of analysis.

Technical ContextAI

Oracle WebLogic Server is a Java EE/Jakarta EE application server widely used to host enterprise web applications and SOA/web-service endpoints. The flaw resides in the WLS Web Services subsystem, which exposes SOAP/XML HTTP endpoints; the 'Authentication Bypass' tag combined with the unauthenticated network vector is consistent with historically recurring WebLogic issues where web-service handlers process attacker input prior to or without enforcing authentication (frequently insecure deserialization or XML external-entity/SSRF-style handling in the T3/HTTP web-service stack). No CWE was assigned in the source data, so the precise root-cause class cannot be confirmed; the CPE cpe:2.3:a:oracle_corporation:oracle_weblogic_server identifies the affected product but does not narrow the exact web-service handler.

RemediationAI

Apply the fixes from Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) to all affected releases - 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 - as the primary and only fully effective remedy; Oracle distributes these as quarterly patch bundles per version rather than a single upgrade target, so select the patch matching your installed release (Patch available per vendor advisory; no standalone fix version was provided in the input beyond the CPU reference). Until patched, reduce exposure by restricting network access to the WebLogic web-services HTTP/HTTPS ports so they are not reachable from untrusted networks, and where web-service endpoints are not required, undeploy or disable them or filter the relevant URL paths (for example /ws, /wls-wsat and other web-service context roots) at a reverse proxy or WAF - noting that blocking these paths will break any legitimate SOAP clients that depend on them. Place WebLogic behind an authenticating gateway and monitor for anomalous web-service requests as a detective control.