Oracle WebLogic Server CVE-2026-60699

The T3 or IIOP protocol listener must be reachable from the attacker's network position - these are enabled by default in WebLogic and typically listen on port 7001 (HTTP/T3) or 7002 (HTTPS/T3S). No authentication is required (PR:N confirmed by CVSS vector), no user interaction is needed, and the attack complexity is low (AC:L), indicating no race conditions or special environmental setup. Exploitation is therefore viable against any default WebLogic installation where the T3 or IIOP port is network-accessible. The primary limiting factor is network reachability: deployments that filter T3/IIOP to only trusted application-tier hosts via firewall rules or WebLogic Connection Filters are significantly harder to exploit. The scope change (S:C) further requires that the attacker's goal includes data accessible through WebLogic's downstream connections; standalone WebLogic deployments without sensitive backend integrations reduce the practical impact of a successful breach.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N reflects an extremely accessible attack profile: fully unauthenticated, low complexity, no user interaction, reachable over the network. The scope change elevates practical impact beyond the WebLogic process itself to connected data stores and services. T3 and IIOP are enabled by default in WebLogic and are frequently left network-accessible in enterprise deployments - especially in internal data center segments - meaning the effective attack surface is large. No EPSS score was provided in the input data. The vulnerability is not currently listed in the CISA KEV catalog and no public proof-of-concept has been identified, which moderates immediate operational urgency compared to the raw CVSS score alone. However, WebLogic T3/IIOP vulnerabilities have historically attracted rapid weaponization (e.g., CVE-2019-2725, CVE-2020-14882), and the Authentication Bypass tag combined with unauthenticated network access represents a structurally high-risk class. Organizations with T3/IIOP exposed beyond a trusted network segment should treat this as a high-priority patch given Oracle WebLogic's typical role as a critical application tier.

An attacker with network-layer access to the WebLogic server's T3 or IIOP listener - such as an external host if the port is internet-facing, or an internal host in a flat network - sends a crafted protocol request without supplying any credentials, exploiting the authentication bypass in the Core component. The server processes the unauthenticated request and returns sensitive application data, potentially including database credentials, configuration secrets, or business data accessible to the WebLogic runtime. No public proof-of-concept exploit has been identified at time of analysis, but the low-complexity unauthenticated vector makes exploitation straightforward once the authentication bypass mechanism is understood.