CVE-2026-60200: Oracle WebLogic Server RCE Vulnerability

CVE-2026-60200 Overview

CVE-2026-60200 is a missing authentication vulnerability [CWE-306] in the Core component of Oracle WebLogic Server, part of Oracle Fusion Middleware. An unauthenticated attacker with network access via Simple Object Access Protocol (SOAP) can compromise the server. Successful exploitation results in complete takeover of the WebLogic Server instance.

Oracle published the flaw in the July 2026 Critical Patch Update. The vulnerability affects supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The Exploit Prediction Scoring System (EPSS) score is 0.522% at the 41.146 percentile as of 2026-07-23.

Critical Impact
Unauthenticated remote attackers can achieve full takeover of Oracle WebLogic Server through a SOAP-accessible endpoint, exposing confidentiality, integrity, and availability of hosted applications.

Affected Products

Oracle WebLogic Server 12.2.1.4.0
Oracle WebLogic Server 14.1.1.0.0
Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0

Discovery Timeline

2026-07-21 - CVE CVE-2026-60200 published to the National Vulnerability Database (NVD)
2026-07-21 - Oracle releases fix in the July 2026 Critical Patch Update
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60200

Vulnerability Analysis

The flaw resides in the Core component of Oracle WebLogic Server. The Common Weakness Enumeration classification [CWE-306] identifies it as Missing Authentication for a Critical Function. A SOAP-accessible code path processes requests without verifying the identity of the caller.

An unauthenticated attacker who reaches the WebLogic listen port over the network can issue crafted SOAP messages to invoke sensitive server functionality. According to Oracle's advisory, successful attacks result in takeover of the WebLogic Server, meaning full loss of confidentiality, integrity, and availability of the application server and hosted workloads.

WebLogic Server deployments frequently host Java Enterprise Edition applications, financial systems, and middleware bridges to backend databases. Compromise of the server therefore provides a pivot into adjacent enterprise systems.

Root Cause

The root cause is missing authentication enforcement on a SOAP-reachable code path within the WebLogic Core component. The server accepts and processes messages that should require authenticated session context, allowing an unauthenticated caller to reach privileged functionality.

Attack Vector

Exploitation occurs over the network with low attack complexity and no user interaction. An attacker sends a crafted SOAP payload to the WebLogic listen port, typically exposed on TCP 7001 or 7002. Because authentication is not required, any host with network reachability to the WebLogic listener can attempt exploitation.

Refer to the Oracle Security Alert July 2026 for vendor technical details. No public proof-of-concept has been observed at the time of writing.

Detection Methods for CVE-2026-60200

Indicators of Compromise

Unauthenticated inbound SOAP requests to WebLogic listener ports (7001, 7002, or custom-configured ports) from unexpected source addresses.
Unexpected child processes spawned by the WebLogic Java process, including shells, cmd.exe, powershell.exe, or scripting interpreters.
New or modified files in WebLogic domain directories, especially under servers/<name>/tmp/ or stage/ deployment paths.
Outbound network connections initiated by the WebLogic server process to attacker-controlled infrastructure.

Detection Strategies

Inspect HTTP and HTTPS access logs for anomalous SOAP endpoint URIs and oversized or malformed XML bodies from unauthenticated sources.
Monitor the WebLogic Java Virtual Machine (JVM) process for behavioral deviations, including unexpected process launches and suspicious file writes.
Alert on WebLogic authentication logs showing privileged actions with no preceding successful login event.

Monitoring Recommendations

Forward WebLogic AdminServer.log, access.log, and domain audit logs to a centralized logging platform for correlation.
Baseline normal SOAP traffic volume and source IP distribution to enable anomaly-based alerts.
Track egress traffic from WebLogic hosts to identify command-and-control or data exfiltration attempts.

How to Mitigate CVE-2026-60200

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all affected WebLogic Server instances without delay.
Inventory all WebLogic deployments and confirm versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 are identified.
Restrict inbound network access to WebLogic listener ports so only trusted management networks and application clients can connect.
Review authentication and access logs for the days preceding patch deployment to identify potential prior exploitation.

Patch Information

Oracle addressed CVE-2026-60200 in the Oracle Security Alert July 2026 (Critical Patch Update). Administrators must download and apply the patch bundle corresponding to their WebLogic Server version through My Oracle Support. Verify patch application by checking the OPatch inventory after installation.

Workarounds

If patching cannot be performed immediately, block external access to WebLogic SOAP endpoints at the network perimeter and web application firewall (WAF).
Disable unused SOAP-exposed services and internal T3/T3S protocols where business requirements permit.
Enforce network segmentation so WebLogic hosts are unreachable from user or internet-facing network segments.

bash

# Example: restrict WebLogic listener access with iptables
# Allow only trusted management subnet 10.20.0.0/24
iptables -A INPUT -p tcp --dport 7001 -s 10.20.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7002 -s 10.20.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7001 -j DROP
iptables -A INPUT -p tcp --dport 7002 -j DROP