CVE-2026-60198: Oracle WebLogic Server RCE Vulnerability

CVE-2026-60198 Overview

CVE-2026-60198 is a critical vulnerability in the Core component of Oracle WebLogic Server, part of Oracle Fusion Middleware. The flaw allows an unauthenticated remote attacker with network access via the T3 or Internet Inter-ORB Protocol (IIOP) protocols to fully compromise the server. Successful exploitation results in complete takeover of the WebLogic Server instance, impacting confidentiality, integrity, and availability. Affected supported versions include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle addressed the issue in the July 2026 Critical Patch Update.

Critical Impact
Unauthenticated network attackers can achieve full takeover of Oracle WebLogic Server through exposed T3 or IIOP endpoints.

Affected Products

Oracle WebLogic Server 12.2.1.4.0
Oracle WebLogic Server 14.1.1.0.0
Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0

Discovery Timeline

2026-07-21 - CVE-2026-60198 published to the National Vulnerability Database (NVD)
2026-07-23 - Last updated in NVD database
July 2026 - Oracle released a fix in the Oracle Critical Patch Update July 2026

Technical Details for CVE-2026-60198

Vulnerability Analysis

The vulnerability resides in the Core component of Oracle WebLogic Server and is reachable through the T3 and IIOP remote protocols. These protocols support Java object exchange between clients and the server. The weakness maps to [CWE-306] Missing Authentication for a Critical Function, meaning a required authentication check is absent on a security-sensitive code path.

An unauthenticated attacker with only network reachability to a listening T3 or IIOP port can trigger the flaw. Oracle rates the issue as easily exploitable, and successful attacks result in full server takeover. This class of WebLogic weakness has historically been abused for remote code execution, lateral movement into internal application tiers, and deployment of web shells or cryptominers.

The Exploit Prediction Scoring System (EPSS) probability is 0.522% as of 2026-07-23, indicating limited observed exploitation activity at the time of publication.

Root Cause

The root cause is missing or insufficient authentication on a Core WebLogic code path exposed through the T3 and IIOP listeners. Because these protocols accept serialized Java objects and remote invocations from the network by default, any gap in pre-authentication validation exposes internal server functionality to untrusted callers. Oracle has not published low-level technical details beyond the July 2026 Critical Patch Update advisory.

Attack Vector

Exploitation requires network access to the WebLogic listen port serving T3, T3S, IIOP, or IIOPS. The attack requires no privileges, no user interaction, and low attack complexity. WebLogic administrative and management channels are commonly bound to the same listen port as application traffic, which increases the exposed surface when T3 and IIOP are not filtered at the network boundary.

No verified public proof-of-concept was available in the enriched data. Refer to the Oracle Critical Patch Update July 2026 for authoritative fix and impact information.

Detection Methods for CVE-2026-60198

Indicators of Compromise

Unexpected inbound TCP connections to WebLogic listen ports (default 7001, 7002) from untrusted networks.
New or modified files under the WebLogic domain directory, particularly JSP or WAR artifacts written by the weblogic process.
Child processes spawned by the WebLogic Java process, such as cmd.exe, powershell.exe, /bin/sh, curl, or wget.
Outbound connections from the WebLogic host to attacker-controlled infrastructure shortly after T3 or IIOP traffic.

Detection Strategies

Inspect WebLogic access and server logs for malformed T3 or IIOP handshakes and deserialization errors preceding process anomalies.
Alert on WebLogic Java processes creating shell interpreters or writing executable content into deployment directories.
Correlate authentication failures and unusual RMI or CORBA calls with subsequent outbound network activity.

Monitoring Recommendations

Enable verbose logging on WebLogic listen threads and forward logs to a centralized analytics platform for retention and correlation.
Baseline expected T3 and IIOP client sources and alert on deviations, especially from internet-facing interfaces.
Monitor for creation of new administrative users, deployed applications, or scheduled tasks on WebLogic hosts.

How to Mitigate CVE-2026-60198

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all affected WebLogic Server instances (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0).
Restrict network access to WebLogic listen ports so that only trusted management networks can reach T3, T3S, IIOP, and IIOPS.
Audit WebLogic hosts for signs of prior compromise, including unauthorized deployments, new accounts, and outbound connections.

Patch Information

Oracle addressed CVE-2026-60198 in the Oracle Critical Patch Update July 2026. Administrators should follow Oracle's documented patching procedure for each affected version and validate patch levels using the Oracle Opatch inventory after installation.

Workarounds

Use the WebLogic Connection Filter (weblogic.security.net.ConnectionFilterImpl) to deny T3 and IIOP from untrusted source addresses when immediate patching is not possible.
Disable IIOP in the WebLogic Server configuration if it is not required by deployed applications.
Place WebLogic administrative interfaces behind a reverse proxy or VPN, and block direct internet exposure of listen ports at the perimeter firewall.

bash

# Example WebLogic connection filter rules (config.xml network-access-management)
# Deny T3 and IIOP from all sources except the internal management subnet
10.10.0.0/16 * * allow t3 t3s iiop iiops
0.0.0.0/0    * * deny  t3 t3s iiop iiops