What is the CVSS score of CVE-2026-60313?

CVE-2026-60313 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle WebLogic Server are affected by CVE-2026-60313?

Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 contain a high-severity authenticated remote code execution vulnerability in the RMI protocol that allows…

How to fix or mitigate CVE-2026-60313?

Within 24 hours, audit all systems running affected WebLogic versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) and implement network segmentation restricting RMI protocol access (default ports 7001/7002) to authorized internal systems only; enable comprehensive logging and monitoring of RMI traffic. Within 7 days, begin pre-production testing of patches expected from Oracle's July 2026 Critical Patch Update and establish maintenance windows with application teams. Within 30 days, deploy patches from the July 2026 Oracle CPU to all affected instances, verify successful patching through version confirmation and security scanning, and remove interim network restrictions.

Oracle WebLogic Server CVE-2026-60313

EUVD-2026-46728 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-w26r-7wrh-3r44

Authentication Bypass Oracle Oracle Weblogic Server Oracle Corporation

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable RMI listener (AV:N) with low complexity (AC:L) exploitable by a low-privilege account (PR:L) and no user interaction, yielding full takeover (C:H/I:H/A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:19 vuln.today

CVE Published

Jul 21, 2026 - 21:34 cve.org

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via RMI to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote code execution / full-server takeover in Oracle WebLogic Server (Fusion Middleware Core component) allows a low-privileged attacker with network access via the RMI protocol to fully compromise the server. Affected supported versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, with CVSS 3.1 base score 8.8 and full confidentiality, integrity and availability impact. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV, but WebLogic RMI flaws are a historically favored target, so patching from the July 2026 Oracle CPU should be prioritized.

Technical ContextAI

Oracle WebLogic Server is a widely deployed Java EE / Jakarta EE application server that exposes management and inter-process services over Java RMI (Remote Method Invocation), typically on the T3/T3S and IIOP protocols. The flaw resides in the Core component and is reached 'via RMI', which in WebLogic historically maps to Java object deserialization of attacker-controlled data on the RMI listener - a class of bug (CWE-502, Deserialization of Untrusted Data) that repeatedly enables remote code execution in this product, though the source CWE is listed as N/A in this record. The CPE cpe:2.3:a:oracle_corporation:oracle_weblogic_server:*:*:*:*:*:*:*:* confirms the application-level WebLogic Server product across versions rather than a specific build.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) - Patch available per vendor advisory; consult the CPU matrix for the exact patched build for your version line (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0) as no single fix version is enumerated in the input. Because the vector is RMI, effective compensating controls until patching is complete include restricting network access to the T3/T3S and IIOP listener ports so only trusted management hosts can reach them (using WebLogic connection filters / weblogic.security.net.ConnectionFilterImpl or a network ACL/firewall), and disabling IIOP and unused remote protocols where not required; the trade-off is that legitimate remote administration, clustering, and JMS/RMI client traffic on those channels will also be blocked, so validate against operational dependencies before enforcing.