Oracle WebLogic Server CVE-2026-60313

Exploitation requires network reachability to the Oracle WebLogic Server RMI interface (typically the T3/T3S or IIOP listener) and a low-privileged authenticated context, as reflected by PR:L in the CVSS vector - it is not fully unauthenticated. The description explicitly names RMI as the attack channel and the Core component as the affected surface, so the RMI/T3 listener must be exposed to the attacker. Limiting factors that reduce real-world risk: the attacker must already hold low-level privileges (not anonymous), must be able to route to the RMI port (often internal-only or firewalled in hardened deployments), and the target must be one of the affected supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 or 15.1.1.0.0; no user interaction is needed and attack complexity is low.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8 HIGH) indicates network-reachable, low-complexity exploitation requiring only low privileges and no user interaction, resulting in total compromise ('takeover') - a genuinely high-priority profile for any internet- or intranet-exposed WebLogic instance. No EPSS score, KEV entry, SSVC decision, or POC was provided, so exploitation probability cannot be quantified from the input and there is currently no public exploit identified; this tempers immediate urgency relative to a KEV-listed bug but does not lower the intrinsic severity. One inconsistency to verify: the record is tagged 'Information Disclosure', yet the description and vector describe full C/I/A takeover including code execution - treat this as a takeover-class RCE, not a mere disclosure issue, and confirm scope with the Oracle advisory.

An attacker with any low-privilege foothold that can reach the WebLogic RMI/T3 listener (e.g. a low-tier application account or an adjacent host on the same network segment) connects to the RMI endpoint and sends a crafted request that WebLogic processes in the Core component, yielding code execution and complete takeover of the server. No user interaction and only low privileges are required per the CVSS vector; no public POC is identified at time of analysis, so exploitation would currently require attacker-developed tooling.