What is the CVSS score of CVE-2026-60294?

CVE-2026-60294 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

How to fix or mitigate CVE-2026-60294?

Within 24 hours: Conduct a complete inventory of WebLogic deployments across your environment, identifying all instances running versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0, and prioritize internet-facing systems. Within 7 days: Implement immediate network controls including firewall rules restricting SOAP protocol (TCP 7001 and administrative ports) to trusted sources only, disable SOAP services where operationally feasible, and deploy WAF rules to block malicious SOAP payloads; simultaneously enable enhanced logging and monitoring on affected instances. Within 30 days: Develop and execute an upgrade strategy to migrate to patched WebLogic releases, or implement compensating cloud-hosted solutions if on-premises patching timelines exceed risk tolerance; coordinate with Oracle for timeline on security patches.

Oracle WebLogic Server CVE-2026-60294

EUVD-2026-46709 CRITICAL

Information Exposure (CWE-200)

2026-07-21 oracle

GHSA-gfvr-mx87-vw5j

Information Disclosure Oracle Oracle Weblogic Server Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach WebLogic SOAP listener port
Delivery

Send crafted SOAP request
Exploit

Trigger Core-component deserialization flaw
Execution

Execute arbitrary code on server
Impact

Full WebLogic host takeover

Vulnerability Assessment

Weakness	CWE CWE-200 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V14 - Data Protection Data exposure prevention MITRE ATT&CK 2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires network reachability to a SOAP-enabled endpoint of an affected Oracle WebLogic Server (versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0) - per CVSS AV:N/AC:L/PR:N/UI:N there is no authentication, no user interaction, and no special non-default configuration called out by Oracle, so default installations exposing WebLogic's SOAP/web-services interface are exploitable. The principal limiting factor is network exposure: the attacker must be able to send SOAP traffic to the server's listen port, so instances that are internally segmented, firewalled, or not exposing web-services/T3 externally are substantially harder to reach. Exploitation is constrained to the four affected supported versions; other builds require verification against the Oracle CPU.
Impact	This is a genuine top-priority issue rather than an inflated high-CVSS-but-low-risk item. Every CVSS signal points to maximum severity: AV:N (network), AC:L (low complexity, described by Oracle as 'easily exploitable'), PR:N (no privileges/unauthenticated), UI:N (no user interaction), and C:H/I:H/A:H yielding a 9.8 base score with full server takeover. No EPSS score was provided in the input, so exploitation probability cannot be quantified numerically, and no SSVC decision data was supplied; both are stated here as missing rather than assumed. The vulnerability is not currently in CISA KEV and no POC is referenced, so active exploitation is unconfirmed - but the combination of unauthenticated network RCE on an internet-facing enterprise middleware product means real-world exploitation risk is high once details or exploit code emerge. Note one tagging inconsistency to verify: the input Tags label this 'Information Disclosure,' which conflicts with the description's I:H/A:H and explicit 'takeover' outcome - the tag appears understated and should not be relied upon.
Exploit ScenarioDerived	An attacker who can reach a WebLogic Server's SOAP-enabled port over the network sends a single crafted SOAP request that triggers the Core-component flaw, requiring no credentials and no user interaction. The malicious message causes the server to process attacker-controlled data (consistent with a deserialization-style gadget chain), yielding arbitrary code execution and full takeover of the WebLogic host. No public POC is referenced in the input, but the low attack complexity means a working exploit could be developed quickly once technical details circulate.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 0.5% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 21, 2026

Remote code execution in Oracle WebLogic Server (Oracle Fusion Middleware Core component) allows an unauthenticated attacker with network access via the SOAP protocol to fully compromise and take over the server. Affected releases are the actively supported 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 versions, and the flaw carries a critical CVSS 3.1 base score of 9.8 with high impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but WebLogic RCE flaws of this class are historically weaponized rapidly.

RemediationAI

Apply the fixes from the Oracle Critical Patch Update July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) to all affected installations of 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0; this is Patch available per vendor advisory, as the CPU bundles the specific patch IDs but the input does not enumerate an exact fixed build number, so obtain the precise patch from the Oracle advisory and My Oracle Support. Because the attack traverses SOAP, apply compensating controls until patched: restrict network access to the WebLogic administration and web-services ports (default 7001/7002 and any custom SOAP listeners) so they are not internet-exposed, place the server behind a WAF/reverse proxy that filters malicious SOAP/XML payloads, and disable or firewall the T3/T3s and IIOP protocols using WebLogic connection filters (weblogic.security.net.ConnectionFilterImpl) if those protocols are not required - noting that blocking T3/IIOP can break legacy clients, clustering, and JMS/RMI integrations, so validate application dependencies before enforcing. Removing unneeded external-facing web-services endpoints and enforcing network segmentation reduces exposure with minimal functional impact for most deployments.

Affected VersionsENISA

Oracle WebLogic Server 12.2.1.4.0

Oracle WebLogic Server 14.1.2.0.0

Oracle WebLogic Server 15.1.1.0.0

Oracle WebLogic Server 14.1.1.0.0

Affected Packages

euvd oracle_weblogic_server no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Oracle WebLogic Server is a Java EE / Jakarta EE application server widely used as the runtime for Oracle Fusion Middleware and many enterprise Java applications. The vulnerability resides in the 'Core' component and is reached over SOAP, WebLogic's XML-based web-services and inter-node messaging protocol (typically layered over T3/IIOP/HTTP). Historically, critical unauthenticated WebLogic Core/SOAP flaws stem from insecure deserialization of untrusted Java objects (CWE-502) in the server's message-handling and XML/gadget-processing paths, which lets an attacker instantiate arbitrary object graphs that execute code. The CWE is not populated in the provided data, so the exact root-cause weakness class is not confirmed from the input, but the 'takeover' outcome and SOAP vector are consistent with the deserialization/injection pattern that recurs in this product's Core component.

Know when Oracle Weblogic Server gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (oracle) PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI 9.8 CRITICAL

Unauthenticated (PR:N) network SOAP vector (AV:N) that Oracle rates easily exploitable (AC:L) with no user interaction, yielding full server takeover so C/I/A all High.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionCVE.org

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SOAP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Executive ViewAI

Why It Matters

Oracle WebLogic Server versions 12.2.1.4.0 through 15.1.1.0.0 are vulnerable to unauthenticated remote code execution (CVE-2026-60294) that enables complete server takeover via SOAP protocol. No public exploit has been identified at time of analysis, but WebLogic RCE vulnerabilities of this type are historically weaponized rapidly; organizations running these actively supported versions face imminent risk of total infrastructure compromise and data breach. No vendor-released patch identified at time of analysis, making immediate interim containment measures critical.

Business Impact: Severe

Compensating Controls

Implement network segmentation to restrict SOAP protocol access (TCP 7001 and administrative ports) to authorized internal networks only; deploy Web Application Firewall (WAF) with rules to detect and block SOAP-based exploitation attempts; disable SOAP protocol services if not required for business operations; enable comprehensive audit logging on all WebLogic instances and implement real-time alerting for anomalous SOAP connection patterns and authentication failures; consider air-gapping affected systems pending patch availability.

Threat Intelligence Overview

EPSS Score

0.5%

Top 59% exploitable

Prevalence

High

widely deployed enterprise Java application server across Oracle Fusion Middleware estates

Data Quality

4 sources

Confidence: Medium

EUVD

NVD

CVE.org

EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.5%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Out-of-Cycle

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

Very High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +1

CVSS: +49

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.