CVE-2026-60201: Oracle WebLogic Server RCE Vulnerability

CVE-2026-60201 Overview

CVE-2026-60201 is a high-severity vulnerability in the Core component of Oracle WebLogic Server, part of Oracle Fusion Middleware. The flaw allows an unauthenticated remote attacker to compromise the server through the T3 or Internet Inter-ORB Protocol (IIOP) network protocols. Successful exploitation results in full takeover of the WebLogic Server instance, impacting confidentiality, integrity, and availability. Oracle disclosed the issue in the July 2026 Critical Patch Update. Affected versions include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The vulnerability is categorized under CWE-306: Missing Authentication for Critical Function.

Critical Impact
Unauthenticated attackers with network access to T3 or IIOP listeners can achieve complete takeover of Oracle WebLogic Server.

Affected Products

Oracle WebLogic Server 12.2.1.4.0
Oracle WebLogic Server 14.1.1.0.0
Oracle WebLogic Server 14.1.2.0.0
Oracle WebLogic Server 15.1.1.0.0

Discovery Timeline

2026-07-21 - Oracle publishes the July 2026 Critical Patch Update addressing the flaw
2026-07-21 - CVE-2026-60201 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60201

Vulnerability Analysis

The vulnerability resides in the Core component of Oracle WebLogic Server. It is reachable over the network through the T3 and IIOP protocols, both of which are used for remote method invocation against WebLogic services. An unauthenticated attacker who can reach these listener ports can send crafted protocol messages that lead to server compromise.

Oracle rates the flaw as difficult to exploit, indicating that specific runtime conditions or protocol state must be met before the attack succeeds. When those conditions are met, the impact is complete: the attacker gains control over confidentiality, integrity, and availability of the WebLogic Server. Because WebLogic often hosts business-critical Java Enterprise applications, a successful takeover typically exposes backend databases, message queues, and integrated identity systems.

The EPSS score is 0.376% with a percentile of 30.13 as of 2026-07-23, and no public proof-of-concept has been observed.

Root Cause

The defect maps to [CWE-306: Missing Authentication for Critical Function]. Sensitive server-side operations exposed through T3 and IIOP are reachable without proper authentication checks. Historically, WebLogic T3/IIOP flaws have involved deserialization of untrusted objects transmitted through these protocols, which allows attacker-controlled gadget chains to execute during unmarshalling. Oracle has not published exploitation specifics beyond the advisory in the July 2026 Critical Patch Update.

Attack Vector

Exploitation requires network access to the WebLogic T3 listener (commonly port 7001) or the IIOP listener. The attacker does not need credentials or user interaction. A crafted T3 or IIOP request is sent to trigger the flaw against the Core component, resulting in remote takeover. Environments that expose T3 or IIOP beyond trusted management networks are at direct risk.

See the Oracle Security Alert July 2026 for the authoritative advisory.

Detection Methods for CVE-2026-60201

Indicators of Compromise

Unexpected inbound connections to WebLogic T3 (default 7001) or IIOP listener ports from untrusted networks.
New or unusual Java processes spawned by the WebLogic managed server, such as cmd.exe, powershell.exe, /bin/sh, or bash as children of java.
Modifications to WebLogic domain directories, deployment folders, or the startup.properties file outside of change windows.
Outbound connections from WebLogic hosts to unknown external IPs shortly after inbound T3/IIOP traffic.

Detection Strategies

Inspect WebLogic access and server logs for malformed T3 or IIOP handshakes and repeated protocol errors from a single source.
Correlate network flow data with WebLogic process telemetry to identify T3/IIOP requests followed by shell or scripting activity.
Hunt for Java deserialization indicators such as serialized object markers (\\xac\\xed\\x00\\x05) in traffic destined for WebLogic ports.

Monitoring Recommendations

Enable verbose T3 and IIOP logging and forward WebLogic logs to a central SIEM for retention and correlation.
Monitor for child processes of java running under the WebLogic service account and alert on shell interpreters or download utilities.
Track file integrity on the WebLogic $DOMAIN_HOME directory, particularly servers/*/tmp and servers/*/stage.

How to Mitigate CVE-2026-60201

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all affected WebLogic Server versions without delay.
Restrict network access to T3 and IIOP listener ports so they are reachable only from trusted administrative segments.
Audit exposed WebLogic instances using external attack surface data and remove internet exposure of management protocols.
Review authentication and access logs on WebLogic hosts for the 30 days preceding patch deployment.

Patch Information

Oracle addressed CVE-2026-60201 in the July 2026 Critical Patch Update. Fixes are available for supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Refer to the Oracle Security Alert July 2026 for patch identifiers and installation instructions.

Workarounds

Disable the T3 and IIOP protocols on any managed server that does not require them, using the WebLogic Administration Console under Protocols configuration.
Configure a WebLogic connection filter (weblogic.security.net.ConnectionFilterImpl) to deny T3 and IIOP traffic from untrusted CIDR ranges.
Place WebLogic listeners behind a reverse proxy or firewall that terminates only HTTP/HTTPS and blocks T3/IIOP at the perimeter.

bash

# Example weblogic.policy connection filter rules to block T3/IIOP from untrusted networks
# Add via Administration Console: Domain > Security > Filter

# Allow only internal management subnet
10.10.0.0/16 * * allow t3 t3s iiop iiops

# Deny all other sources
0.0.0.0/0 * * deny t3 t3s iiop iiops