Oracle WebLogic Server CVE-2026-60702

Exploitation requires network reachability to Oracle WebLogic Server's T3 or IIOP listener (commonly TCP 7001/7002) and low-level privileges on the target (CVSS PR:L), with no user interaction needed. The concrete prerequisite is that the T3 and/or IIOP protocol is enabled and reachable by the attacker - the default WebLogic configuration exposes T3 on the listen port. Limiting factors: the attacker must hold some low privilege rather than being fully anonymous (PR:L, not PR:N), and exploitation is only possible where the T3/IIOP port is not filtered - environments that restrict these protocols with connection filters or network ACLs, or that do not expose the listen port, materially reduce exposure. Affected only on versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0.

This is a genuine top-priority issue rather than an inflated high-CVSS score: the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H combines network reachability, low attack complexity, no user interaction, only low privileges required, full confidentiality/integrity/availability loss, and a scope change that lets impact spread beyond WebLogic. Oracle explicitly calls it 'easily exploitable' and describes the outcome as 'takeover,' which aligns with the maximal impact metrics. EPSS was not provided and the CVE is not currently in CISA KEV, and no POC is referenced, so there is no evidence of active exploitation yet - but T3/IIOP deserialization bugs in WebLogic have a strong track record of rapid exploitation once details surface, so any operator, whether a large enterprise or a mid-sized municipal IT team, should treat this as urgent and patch on Oracle's Critical Patch Update cycle. The main mitigating factor is that PR:L requires some level of authenticated/low-privilege access, and internet exposure of the T3/IIOP port is the primary risk multiplier.

An attacker with low-level access to the network segment where WebLogic's T3/IIOP port is reachable sends a crafted serialized object to the listener; the Core component deserializes it and executes attacker code, yielding full server takeover. Because of the scope change, the attacker can then pivot to impact adjacent systems and data the compromised server can reach. No public POC is identified at time of analysis, but the low complexity and no-user-interaction profile make reliable exploitation straightforward once a working gadget chain is known.