Oracle WebLogic Server CVE-2026-60312

Exploitation requires network access to the WebLogic Server's T3 (or T3S) or IIOP listener - typically the default listen port 7001/7002 - reachable from the attacker. No authentication (PR:N) and no user interaction (UI:N) are needed against affected instances, so an internet-exposed or broadly-reachable listen port is the core prerequisite. The principal limiting factor is exploit complexity: Oracle rates this AC:H ('difficult to exploit'), indicating the attacker must meet a specific, non-trivial condition (e.g., timing, server state, or configuration) rather than firing a single deterministic payload. Environments that firewall T3/IIOP to trusted hosts, disable IIOP, or run a connection filter substantially raise the bar. Affected only on versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0.

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.1 High) captures the tension in this issue: it is network-reachable and needs no authentication or user interaction, but Oracle explicitly rates it 'difficult to exploit' (AC:H), implying a race, non-deterministic condition, or a specific state the attacker must engineer. Impact is maximal - full server takeover across C/I/A. Countervailing signals limiting priority: no EPSS score was provided, the CVE is not on CISA KEV, and no public PoC was identified, so there is no evidence of active or imminent mass exploitation. That said, WebLogic T3/IIOP flaws are a perennial, heavily-weaponized target class once PoCs appear, and internet-exposed listen ports make this attractive. Net assessment: a genuine high-priority patch item for any internet-facing or widely-reachable WebLogic instance, tempered by the high exploit complexity and absence of current exploitation intelligence. Note the gap: EPSS and SSVC data were not supplied and could not be weighed.

An attacker with network reach to an exposed WebLogic listen port sends a crafted T3 or IIOP request to the Core component and, after satisfying the high-complexity trigger condition, causes the server to process an attacker-controlled object, resulting in full takeover of the WebLogic instance. No credentials or user interaction are required. No public exploit was identified at time of analysis, so this scenario reflects the described capability rather than an observed campaign.