Oracle WebLogic Server CVE-2026-60696

The one hard prerequisite is network reachability of WebLogic's T3 or IIOP protocol endpoint (default T3 on the WebLogic listen port such as 7001, plus IIOP where enabled) from the attacker's position - the CVSS vector is AV:N/AC:L/PR:N/UI:N, so against a default configuration exposing T3/IIOP there are no authentication, privilege, user-interaction, or special feature-flag requirements. What limits exploitation in practice is exposure: if T3/IIOP ports are firewalled to trusted management hosts or connection filters restrict source addresses, an external attacker cannot reach the vulnerable protocol. Exploitation is confined to the four affected supported versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0).

Every objective signal points to maximum priority: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated, no-interaction attack, and the impact is total (C:H/I:H/A:H, 'takeover'). T3/IIOP are frequently exposed on management/internal ports and are a repeatedly weaponized WebLogic attack surface, so the practical bar to exploitation is low once the port is reachable. There is no CISA KEV listing and no public POC in the provided data, and no EPSS score was supplied, so I cannot cite a numeric exploitation probability - but absence of a POC is not reassurance for a 9.8 unauthenticated RCE in ubiquitous middleware, and any operator running an affected version should treat this as urgent rather than wait for exploitation to be observed. The main uncertainty is exposure: real-world risk is highest where T3/IIOP is reachable from untrusted networks and lower where those ports are firewalled to trusted management hosts.

An attacker who can reach the WebLogic T3 or IIOP listen port sends a crafted serialized-object request to the exposed remoting endpoint, requiring no credentials and no user interaction. The malicious payload is deserialized by the server and drives code execution, giving the attacker control of the WebLogic process and effectively full server takeover. No public exploit code was identified in the provided data, but the low complexity and unauthenticated vector make weaponization straightforward for a capable actor.