Oracle WebLogic Server CVE-2026-60977

Exploitation requires network access to the WebLogic Server's RMI interface (the T3/T3S or IIOP listener, by default on ports 7001/7002) reachable by the attacker; per the CVSS vector AV:N/AC:L/PR:N/UI:N there are no special conditions - remote unauthenticated exploitation against default configurations of affected Oracle WebLogic Server 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0. The primary limiting factor is network exposure of the RMI/T3/IIOP port: servers whose T3/IIOP listeners are firewalled off from untrusted networks or filtered via connection filters are not remotely reachable. Only the three listed supported versions are confirmed affected.

Every available signal points to high real-world risk: the CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H means network reachable, low complexity, no privileges, no user interaction, and full CIA impact - the classic 9.8 profile. Oracle explicitly rates it 'easily exploitable' by an unauthenticated attacker, which aligns with AC:L/PR:N. EPSS, KEV, and SSVC data were not provided, so exploitation probability and automatability cannot be quantified here; there is no confirmed active exploitation and no public POC at time of analysis. The mismatch between the 'Information Disclosure' tag and the C:H/I:H/A:H 'takeover' description is notable - treat the vector and 'takeover' language as authoritative, since WebLogic RMI flaws of this class typically yield RCE, not just disclosure.

An attacker with network reachability to an exposed WebLogic T3/IIOP RMI port sends a crafted RMI request to the WLS Core Components, requiring no credentials or user interaction. The single low-complexity request results in full server takeover, giving the attacker code execution and control over hosted applications and data. No public POC was identified at time of analysis, though the unauthenticated, low-complexity profile makes reliable exploitation likely once details circulate.