What is the CVSS score of CVE-2026-60294?

CVE-2026-60294 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebLogic Server are affected by CVE-2026-60294?

Oracle WebLogic Server versions 12.2.1.4.0 through 15.1.1.0.0 are vulnerable to unauthenticated remote code execution (CVE-2026-60294) that enables complete server takeover via SOAP protocol.

How to fix or mitigate CVE-2026-60294?

Within 24 hours: Conduct a complete inventory of WebLogic deployments across your environment, identifying all instances running versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0, and prioritize internet-facing systems. Within 7 days: Implement immediate network controls including firewall rules restricting SOAP protocol (TCP 7001 and administrative ports) to trusted sources only, disable SOAP services where operationally feasible, and deploy WAF rules to block malicious SOAP payloads; simultaneously enable enhanced logging and monitoring on affected instances. Within 30 days: Develop and execute an upgrade strategy to migrate to patched WebLogic releases, or implement compensating cloud-hosted solutions if on-premises patching timelines exceed risk tolerance; coordinate with Oracle for timeline on security patches.

Oracle WebLogic Server CVE-2026-60294

EUVD-2026-46709 CRITICAL

Information Exposure (CWE-200)

2026-07-21 oracle

GHSA-gfvr-mx87-vw5j

Information Disclosure Oracle Oracle Weblogic Server Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated (PR:N) network SOAP vector (AV:N) that Oracle rates easily exploitable (AC:L) with no user interaction, yielding full server takeover so C/I/A all High.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:26 vuln.today

CVE Published

Jul 21, 2026 - 21:34 cve.org

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SOAP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote code execution in Oracle WebLogic Server (Oracle Fusion Middleware Core component) allows an unauthenticated attacker with network access via the SOAP protocol to fully compromise and take over the server. Affected releases are the actively supported 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 versions, and the flaw carries a critical CVSS 3.1 base score of 9.8 with high impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but WebLogic RCE flaws of this class are historically weaponized rapidly.

Technical ContextAI

Oracle WebLogic Server is a Java EE / Jakarta EE application server widely used as the runtime for Oracle Fusion Middleware and many enterprise Java applications. The vulnerability resides in the 'Core' component and is reached over SOAP, WebLogic's XML-based web-services and inter-node messaging protocol (typically layered over T3/IIOP/HTTP). Historically, critical unauthenticated WebLogic Core/SOAP flaws stem from insecure deserialization of untrusted Java objects (CWE-502) in the server's message-handling and XML/gadget-processing paths, which lets an attacker instantiate arbitrary object graphs that execute code. The CWE is not populated in the provided data, so the exact root-cause weakness class is not confirmed from the input, but the 'takeover' outcome and SOAP vector are consistent with the deserialization/injection pattern that recurs in this product's Core component.

RemediationAI

Apply the fixes from the Oracle Critical Patch Update July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) to all affected installations of 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0; this is Patch available per vendor advisory, as the CPU bundles the specific patch IDs but the input does not enumerate an exact fixed build number, so obtain the precise patch from the Oracle advisory and My Oracle Support. Because the attack traverses SOAP, apply compensating controls until patched: restrict network access to the WebLogic administration and web-services ports (default 7001/7002 and any custom SOAP listeners) so they are not internet-exposed, place the server behind a WAF/reverse proxy that filters malicious SOAP/XML payloads, and disable or firewall the T3/T3s and IIOP protocols using WebLogic connection filters (weblogic.security.net.ConnectionFilterImpl) if those protocols are not required - noting that blocking T3/IIOP can break legacy clients, clustering, and JMS/RMI integrations, so validate application dependencies before enforcing. Removing unneeded external-facing web-services endpoints and enforcing network segmentation reduces exposure with minimal functional impact for most deployments.