Oracle WebLogic Server CVE-2026-60698

The attacker must have network access to the Oracle WebLogic Server IIOP interface/listener; exploitation is unauthenticated (PR:N) and requires no user interaction (UI:N), matching Oracle's 'easily exploitable' characterization. The concrete prerequisite is that the IIOP protocol is enabled and its port is reachable by the attacker - WebLogic enables IIOP by default on its listen ports, so default deployments are at risk unless IIOP has been disabled or firewalled. Limiting factors that reduce real-world exposure: deployments that disable IIOP, restrict the T3/IIOP listener to trusted management networks, or place WebLogic behind filtering that blocks IIOP from untrusted sources are not remotely reachable by external attackers. Affected versions are limited to 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.

Every signal that is present points to top-tier priority: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) describes network-reachable, low-complexity, unauthenticated exploitation with total system compromise, and Oracle itself characterizes it as 'easily exploitable.' Countervailing context matters, though: this CVE is not listed in CISA KEV and no POC is referenced, so active exploitation is not confirmed and EPSS is not provided in the input - the urgency here rests on severity and the historically-abused IIOP attack surface rather than on observed in-the-wild activity. Given that WebLogic IIOP flaws of this exact shape have repeatedly been exploited shortly after disclosure, defenders should not wait for a KEV listing before acting; any organization running an internet-exposed or broadly network-reachable WebLogic instance, from a large enterprise down to a mid-sized municipal IT team in boleslawiec, should treat this as urgent and assume exploit development is feasible. The one caveat to verify is exposure scope: the real-world blast radius depends heavily on whether the IIOP port is reachable from untrusted networks, which many hardened deployments restrict.

An attacker who can reach the WebLogic IIOP listener sends a crafted IIOP request carrying a malicious serialized object; the server deserializes it and executes attacker-supplied logic, yielding remote code execution as the WebLogic process account with no credentials or user interaction. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, this requires only network reachability to the IIOP port. No public exploit is identified at time of analysis, but prior WebLogic IIOP flaws were exploited quickly after disclosure.