Oracle WebLogic Server CVE-2026-60679

The attacker must possess at minimum low-level credentials granting network access to the WebLogic instance - the CVSS PR:L metric confirms that fully anonymous/unauthenticated exploitation is not supported. Network reachability to the T3 or IIOP listener (typically TCP 7001 or 7002) is required; environments enforcing firewall restrictions on these ports to trusted internal segments substantially reduce exposure. The High Attack Complexity (AC:H) constraint means exploitation is not reliable via a simple crafted packet - the attacker must satisfy additional technical conditions such as specific server state, protocol sequencing, or timing requirements, the exact details of which Oracle has not disclosed. Scope is unchanged (S:U), meaning the vulnerability's impact is bounded to the targeted WebLogic server instance and does not inherently enable lateral movement to adjacent systems through the vulnerability mechanism itself.

The CVSS 3.1 score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a serious but conditionally constrained vulnerability. AC:H is a meaningful real-world limiter - reliable exploitation requires meeting specific technical prerequisites beyond a simple request/response, such as race conditions, complex protocol state, or credential prerequisites, which reduces the likelihood of automated mass exploitation. PR:L confirms that some level of credentials or session access is required, ruling out fully anonymous exploitation. The full C:H/I:H/A:H triad confirms that when conditions are met, the outcome is complete server compromise. No CISA KEV listing and no POC are present in the provided data, and EPSS is not available from the supplied sources. Taken together, this is a high-priority patch item for the next scheduled maintenance window rather than an emergency break-glass response, with interim network controls warranted for internet-exposed T3/IIOP listeners.

An attacker holding low-privilege WebLogic credentials - such as a developer, monitoring, or application service account - connects to the WebLogic T3 or IIOP listener on the management port and sends a specially crafted protocol payload targeting the Core component. After satisfying the high-complexity exploitation conditions (the exact nature of which Oracle has not publicly disclosed), the attacker achieves full server takeover including arbitrary code execution, unrestricted data access, and denial of service capability. No public proof-of-concept code has been identified at time of analysis.