Oracle WebLogic Server CVE-2026-60415

Exploitation requires network access to Oracle WebLogic Server's T3 or IIOP listener, both of which are enabled by default in standard WebLogic installations - no non-default configuration is required to be exposed. No authentication is required (PR:N per CVSS). High attack complexity (AC:H) means a specific condition must be satisfied during the attack, such as a timing window, race condition, or protocol state dependency, preventing trivial or fully automated exploitation by unskilled attackers. Limiting factors include: AC:H constraining reliable exploit development; network segmentation or firewall rules blocking T3 (default ports 7001/7002) and IIOP from untrusted networks; and the absence of known public exploit code at time of analysis. A tag discrepancy ('Information Disclosure' vs. full-takeover CVSS impact) has not been resolved from available data - defenders should verify precise impact scope with Oracle's advisory before finalizing risk tier decisions.

The CVSS 3.1 score of 8.1 conveys high intrinsic severity - full triad impact (C:H/I:H/A:H) with no authentication or user interaction required - but is tempered by AC:H, indicating that exploitation is not straightforward and likely requires meeting specific timing, state, or environmental conditions. No EPSS score was provided, no CISA KEV listing is present, and no POC code has been reported, all of which suggest this is not currently being exploited at scale. These signals together place this vulnerability in the 'high priority for patching but not emergency zero-day response' tier. One notable discrepancy: the input tags classify this as 'Information Disclosure,' yet the CVSS vector asserts full C:H/I:H/A:H impact - this conflict should be resolved by consulting Oracle's official advisory before communicating impact scope to stakeholders. T3 and IIOP ports are frequently exposed within enterprise internal networks, meaning network segmentation alone may not be a reliable compensating control in many environments.

An unauthenticated remote attacker with access to WebLogic's T3 or IIOP port sends a specially crafted protocol-level request engineered to satisfy the high-complexity exploitation condition - likely a specific race condition, object state, or protocol handshake sequence. Upon meeting that condition, the attacker achieves arbitrary code execution running under the WebLogic server process account, gaining full control of the server. No public exploit code has been identified at time of analysis, but the T3/IIOP attack surface in WebLogic has produced multiple weaponized critical exploits historically, suggesting skilled actors could develop working exploit code.