What is the CVSS score of CVE-2026-60312?

CVE-2026-60312 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Oracle WebLogic Server are affected by CVE-2026-60312?

Oracle WebLogic Server deployments running versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0 face critical risk of complete system compromise from unauthenticated remote attackers, with no…

How to fix or mitigate CVE-2026-60312?

Within 24 hours, conduct rapid inventory of all Oracle WebLogic instances and identify which specific versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) are deployed in production environments. Within 7 days, implement network firewall rules restricting access to T3 (port 7002) and IIOP (port 7003) protocols to authorized internal networks only, disable these protocols where operationally feasible, and deploy network-based intrusion detection signatures targeting T3/IIOP-based exploitation attempts. Within 30 days, monitor Oracle's Critical Patch Update releases for vendor patches applicable to all affected WebLogic versions; if patches remain unavailable, initiate evaluation of application migration to patched WebLogic versions or alternative application server platforms.

Oracle WebLogic Server CVE-2026-60312

EUVD-2026-46727 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-2j2f-pqxr-xr4h

Authentication Bypass Oracle Oracle Weblogic Server Oracle Corporation

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable via T3/IIOP with no auth or interaction (AV:N/PR:N/UI:N) but Oracle-rated difficult to exploit (AC:H); full takeover gives C:H/I:H/A:H, no scope change.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:20 vuln.today

CVE Published

Jul 21, 2026 - 21:34 cve.org

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Server takeover in Oracle WebLogic Server (Fusion Middleware, Core component) lets an unauthenticated remote attacker fully compromise affected instances by abusing the proprietary T3 and IIOP remote protocols. Supported releases 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 are vulnerable, and successful exploitation yields complete confidentiality, integrity and availability loss. No public exploit identified at time of analysis; the flaw is rated high complexity (CVSS 8.1) and was disclosed in Oracle's July 2026 Critical Patch Update.

Technical ContextAI

WebLogic Server is Oracle's flagship Java EE application server underpinning much of Oracle Fusion Middleware. The exposure lies in the Core component and is reached through T3 (Oracle's proprietary RMI transport) and IIOP (CORBA-over-IIOP), both of which historically carry Java-serialized object streams. This class of WebLogic Core/T3/IIOP defect has repeatedly stemmed from insecure deserialization of untrusted data (CWE-502), where a crafted serialized payload delivered over the listen port is instantiated server-side and drives arbitrary behavior. The CWE was not supplied by the source (CWE: N/A), so the deserialization root cause is inferred from the affected protocols rather than confirmed. The single affected CPE (cpe:2.3:a:oracle_corporation:oracle_weblogic_server) uses a wildcard version, so precise affected builds come from the description's enumerated releases rather than the CPE.

RemediationAI

Patch available per vendor advisory: apply the fixes in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) to each affected release - 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0; Oracle does not publish a discrete fixed build number in the source data, so obtain the exact patch set for your version from the CPU matrix. Because the vector is T3 and IIOP, the strongest compensating control until patching is to restrict these protocols: use a WebLogic Connection Filter (weblogic.security.net.ConnectionFilterImpl) to allow T3/T3S/IIOP only from trusted management hosts, or disable IIOP in the server's Protocols configuration if not required (side effect: breaks CORBA/EJB-over-IIOP clients and some remote JMX/admin tooling). Additionally, block external access to the WebLogic listen and administration ports (default 7001/7002) at the network firewall so T3/IIOP is never reachable from untrusted networks (side effect: remote administrative and cluster traffic must be re-scoped to an internal segment or VPN). These controls reduce exposure but are not a substitute for the CPU patch.