What is the CVSS score of EUVD-2026-46707?

EUVD-2026-46707 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Weblogic Server are affected by EUVD-2026-46707?

Oracle WebLogic Server versions 12.2.1.4.0 and 14.1.1.0.0 are vulnerable to complete unauthenticated remote takeover via crafted HTTP requests to the Core component.

How to fix or mitigate EUVD-2026-46707?

Within 24 hours, inventory all WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 instances across production and non-production environments and implement strict firewall rules restricting access to WebLogic administrative ports (7001, 7002) to authorized internal systems only. Within 7 days, deploy WAF/IDS signatures targeting exploitation attempts against the Core component and establish enhanced monitoring with real-time alerting for suspicious HTTP traffic to these systems. Within 30 days, develop and begin testing an upgrade path to patched WebLogic versions, or harden compensating controls if immediate migration is not feasible.

Oracle Weblogic Server EUVD-2026-46707

| CVE-2026-60292 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 oracle

GHSA-jj7j-v98p-cfq5

Authentication Bypass Oracle Oracle Weblogic Server Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:27 vuln.today

CVE Published

Jul 21, 2026 - 21:34 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Complete takeover of Oracle WebLogic Server 12.2.1.4.0 and 14.1.1.0.0 is possible by remote, unauthenticated attackers sending crafted HTTP traffic to the Core component, per Oracle's July 2026 Critical Patch Update. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N, full C/I/A impact) reflects trivially exploitable, network-facing compromise with no authentication or user interaction. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but WebLogic's history as a high-value RCE target makes this a top-priority patch.