EUVD-2026-61393
GHSA-3j68-w34w-39gr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed T3/IIOP listener
-
DeliverySend crafted T3/IIOP request to Core
-
ExploitTrigger unauthenticated flaw in WebLogic
-
ExecutionGain code execution on server
-
ImpactFull server takeover and data access
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the WebLogic Server's T3 (default TCP 7001/7002) or IIOP listener - these are the exact protocols named by Oracle as the attack path. No authentication, no privileges, and no user interaction are needed (PR:N/UI:N), and default configurations expose T3 on the standard admin/managed-server ports, so an internet-exposed or flat-network instance is directly at risk. What LIMITS exploitation is network exposure of T3/IIOP: instances where these protocols are firewalled off, restricted via WebLogic connection filters to trusted hosts, or where IIOP is disabled are not remotely reachable by an arbitrary attacker. Affected releases are limited to WebLogic 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. |
| Impact | This should be treated as a top-priority, patch-now issue: the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes trivial, remote, unauthenticated exploitation yielding total compromise, and Oracle itself labels it 'easily exploitable' - so even a mid-sized municipal IT team in gliwice running an internet-reachable WebLogic instance should treat this as urgent and assume exposure. No EPSS score, KEV listing, or POC was provided, so probabilistic and active-exploitation signals are currently absent rather than negative; the absence of data is not evidence of low risk, especially given WebLogic's long history of exploited T3/IIOP flaws. Note a conflict between signals worth verifying: the input Tags say 'Information Disclosure,' whereas the description and CVSS I/A:H indicate full takeover, not mere disclosure - trust the description/vector over the tag. Overall this is a genuine priority, not a high-CVSS-but-low-real-risk item, particularly for instances with T3/IIOP exposed beyond a trusted network. |
| Exploit ScenarioDerived | An attacker who can reach a WebLogic instance's T3 or IIOP listener over the network sends a crafted request to the Core component and, without any credentials or user interaction, gains control of the server, leading to full takeover and arbitrary access to hosted applications and data. Because Oracle rates it 'easily exploitable' with low attack complexity, a reliable exploit could be scripted for mass scanning once details emerge. No public POC was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 18, 2026
Full server takeover in Oracle WebLogic Server (Fusion Middleware Core component) allows a remote, unauthenticated attacker with network access via the T3 or IIOP protocols to completely compromise affected instances (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0). The flaw carries a CVSS 3.1 base score of 9.8 with high confidentiality, integrity and availability impact and requires no privileges or user interaction. There is no public exploit identified at time of analysis, but WebLogic T3/IIOP deserialization flaws are historically rapid targets for weaponization.
RemediationAI
Apply the fixes from the Oracle August 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cspuaug2026.html) to each affected release; Oracle delivers these as CPU patch bundles rather than a single named version, so select the patch corresponding to your exact installed version (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 or 15.1.1.0.0) - no standalone fix version string was provided in the input to cite verbatim. Until patched, reduce the T3/IIOP attack surface: use WebLogic's Connection Filter (weblogic.security.net.ConnectionFilterImpl) to allow T3/T3S/IIOP only from trusted management hosts, or disable IIOP in the server configuration if unused, and ensure ports 7001/7002 (and any custom T3 channels) are not reachable from the internet by placing WebLogic behind a firewall or reverse proxy that does not forward T3/IIOP. Trade-offs: connection filters and IIOP disablement can break legitimate RMI/EJB clients and inter-domain communication, so validate against application dependencies before enforcing in production.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle WebLogic Server is a Java EE application server within Oracle Fusion Middleware; the affected 'Core' component underlies the proprietary T3 (and T3S) remoting protocol and the standards-based IIOP (Internet Inter-ORB Protocol) used by RMI clients. Both protocols carry serialized Java objects, and this class of WebLogic vulnerability has repeatedly stemmed from unsafe Java deserialization (CWE-502) reachable before authentication. No CWE was supplied in the input, so the precise root cause is not confirmed, but the network-facing, unauthenticated, T3/IIOP attack surface described is consistent with the deserialization/gadget-chain pattern seen in prior WebLogic Core CVEs. Oracle publishes fixes exclusively through its quarterly Critical Patch Update rather than per-CVE advisories.
Know when Weblogic Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Oracle describes easy, remote, unauthenticated T3/IIOP exploitation with full server takeover, so AV:N/AC:L/PR:N/UI:N and C/I/A all High.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 contain a critical vulnerability (CVE-2026-60672, CVSS 9.8) enabling unauthenticated remote attackers to achieve complete server compromise via T3 or IIOP protocols. Any organization running Fusion Middleware Core on these versions faces immediate risk due to the lack of available patch and historical rapid weaponization of similar WebLogic deserialization flaws.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict T3/IIOP port access via firewall rules, implement WAF rules blocking WebLogic deserialization attack signatures, disable T3 and IIOP protocols if operationally feasible, enable enhanced audit logging on authentication and RMI activity, deploy affected systems behind network proxies or reverse proxies, implement network segmentation isolating WebLogic infrastructure from untrusted networks, and monitor for exploitation indicators including unusual JMX connections and RMI registry access patterns.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Weblogic Server
View allVulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Rated cr
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception ha
Oracle WebLogic Server allows unauthenticated remote code execution through the WLS Security component's T3 protocol, ma
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Core Components). Rated
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events
In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16,
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, an
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursio
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Lo
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
Exploit-DB