What is the CVSS score of CVE-2026-60343?

CVE-2026-60343 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle WebLogic Server are affected by CVE-2026-60343?

A vulnerability in Oracle WebLogic Server versions 12.2.1.4.0 and 14.1.1.0.0 enables full server takeover by low-privileged attackers with HTTP network access, rated 'easily exploitable' by Oracle.

How to fix or mitigate CVE-2026-60343?

Within 24 hours, inventory all Oracle WebLogic Server instances to identify those running versions 12.2.1.4.0 or 14.1.1.0.0 and escalate any production systems to incident response. Within 7 days, apply Oracle's July 2026 Critical Patch Update to all affected systems, validating patches in non-production environments first to ensure stability. Within 30 days, complete deployment to all production instances and confirm patch status through vendor patch-level reporting tools.

Oracle WebLogic Server CVE-2026-60343

EUVD-2026-46757 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-9hm6-79cm-xrr8

Authentication Bypass Oracle Weblogic Server

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network HTTP reach with low complexity and no interaction, but a low-privilege authenticated foothold is required (PR:L); full server takeover yields C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:48 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full server takeover in Oracle WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 (Fusion Middleware, Core component) lets a low-privileged attacker with only HTTP network access compromise the entire server. Successful exploitation delivers high confidentiality, integrity, and availability impact (CVSS 3.1 8.8), effectively granting control of the WebLogic instance. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but Oracle rates it 'easily exploitable' and shipped a fix in the July 2026 Critical Patch Update.

Technical ContextAI

Oracle WebLogic Server is a Java EE / Jakarta EE application server that forms the runtime backbone of Oracle Fusion Middleware, hosting enterprise web applications, EJBs, JMS, and administrative services over HTTP and T3. The flaw resides in the 'Core' subsystem, which handles fundamental request processing and application-server plumbing rather than a peripheral add-on, so a Core-level takeover implies broad control over the server process. Oracle assigned no CWE and provides no root-cause class; the WebLogic Core component has historically been associated with deserialization and request-handling weaknesses, though that specific mechanism is not confirmed for this CVE. Affected releases are the long-term 12.2.1.4.0 and 14.1.1.0.0 branches, both of which remain common in Oracle middleware estates.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (patch available per vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html) for the affected 12.2.1.4.0 and 14.1.1.0.0 branches; Oracle's input does not enumerate a discrete fixed build number beyond the CPU bundle, so schedule the CPU patch set as the primary and authoritative remediation. As compensating controls until patching completes, restrict network reachability of the WebLogic administrative and application HTTP ports to trusted management networks or a jump host, place the server behind a WAF or reverse proxy that filters anomalous requests to Core endpoints, and tighten account hygiene so the low-privilege credentials this attack requires cannot be trivially obtained or reused - note that locking down ports may disrupt legitimate remote administration and integrations, so validate application flows before enforcing. Monitor authentication and HTTP access logs for unexpected low-privilege sessions performing administrative actions.