CVE-2026-60199: Oracle WebLogic Server RCE Vulnerability

CVE-2026-60199 Overview

CVE-2026-60199 is a missing authentication vulnerability [CWE-306] in the Core component of Oracle WebLogic Server, part of Oracle Fusion Middleware. Affected versions include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. An unauthenticated attacker with network access over HTTP can compromise the server without user interaction. Successful exploitation results in full takeover of Oracle WebLogic Server, impacting confidentiality, integrity, and availability. Oracle disclosed the issue in the July 2026 Critical Patch Update.

Critical Impact
Unauthenticated remote attackers can take over Oracle WebLogic Server instances exposed to HTTP traffic, gaining control over hosted applications and data.

Affected Products

Oracle WebLogic Server 12.2.1.4.0
Oracle WebLogic Server 14.1.1.0.0 and 14.1.2.0.0
Oracle WebLogic Server 15.1.1.0.0

Discovery Timeline

2026-07-21 - CVE-2026-60199 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60199

Vulnerability Analysis

The flaw resides in the Core component of Oracle WebLogic Server. Oracle classifies exploitation as easy, requiring only network access via HTTP. Attackers do not need credentials, and no user interaction is required. Successful exploitation results in complete server takeover, granting the attacker control over deployed Java EE applications, associated data stores, and downstream systems reachable from the WebLogic host.

The Common Weakness Enumeration classification is [CWE-306] Missing Authentication for Critical Function. This indicates that a critical WebLogic function is reachable without authenticating the caller. Oracle has not published low-level technical detail, consistent with its Critical Patch Update disclosure practice.

Root Cause

The root cause is a missing authentication check on a network-exposed function within the WebLogic Core. Requests routed to the vulnerable handler bypass identity verification, allowing arbitrary callers to invoke privileged server functionality. This class of defect commonly enables remote code execution or administrative operations against the middleware layer.

Attack Vector

Exploitation occurs over the network using HTTP requests directed at an exposed WebLogic listener. The attacker crafts a request that reaches the unauthenticated function path. Because no credentials or session state are required, internet-facing WebLogic instances are directly reachable. Post-exploitation access typically extends to any resource the WebLogic process account can reach, including databases and internal services.

Refer to the Oracle Security Alert July 2026 for the authoritative advisory.

Detection Methods for CVE-2026-60199

Indicators of Compromise

Unexpected outbound network connections originating from WebLogic Java processes to unknown hosts.
New or modified files under WebLogic deployment directories such as servers/<name>/tmp or applications/.
Unauthorized administrative accounts or role assignments appearing in the WebLogic domain configuration.
Anomalous child processes spawned by the WebLogic JVM, particularly shells or scripting interpreters.

Detection Strategies

Inspect WebLogic access logs for unauthenticated requests to management or Core component URIs immediately followed by 200 responses.
Correlate HTTP requests against WebLogic listeners with subsequent process creation events on the host.
Alert on JVM processes writing to filesystem locations outside their normal deployment paths.

Monitoring Recommendations

Enable verbose HTTP access logging on all WebLogic managed servers and forward logs to a central SIEM.
Monitor egress traffic from WebLogic hosts and baseline expected destinations.
Track configuration changes to config.xml and domain security realms using file integrity monitoring.

How to Mitigate CVE-2026-60199

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all affected WebLogic Server versions without delay.
Restrict network access to WebLogic administrative and HTTP listeners to trusted management networks only.
Inventory internet-exposed WebLogic instances and prioritize them for patching first.
Review authentication and access logs on affected servers for signs of prior exploitation.

Patch Information

Oracle addressed CVE-2026-60199 in the July 2026 Critical Patch Update. Administrators should install the patch corresponding to their WebLogic version: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0. Full patch details are available in the Oracle Security Alert July 2026.

Workarounds

Place WebLogic servers behind a reverse proxy or web application firewall that enforces authentication before requests reach WebLogic.
Block external access to non-essential WebLogic ports at the network perimeter.
Run WebLogic under a least-privilege operating system account to limit post-exploitation impact.

bash

# Example: restrict WebLogic HTTP listener to internal network via iptables
iptables -A INPUT -p tcp --dport 7001 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 7001 -j DROP