CVE-2026-60202: Oracle WebLogic Server RCE Vulnerability

CVE-2026-60202 Overview

CVE-2026-60202 is a critical vulnerability in the Core component of Oracle WebLogic Server, part of Oracle Fusion Middleware. An unauthenticated attacker with network access via the T3 or Internet Inter-ORB Protocol (IIOP) can compromise the server and achieve full takeover. The flaw is classified under CWE-306: Missing Authentication for Critical Function.

Affected supported versions include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle addressed the issue in its July 2026 Critical Patch Update.

Critical Impact
Successful exploitation results in complete takeover of the WebLogic Server, compromising confidentiality, integrity, and availability without any authentication or user interaction.

Affected Products

Oracle WebLogic Server 12.2.1.4.0
Oracle WebLogic Server 14.1.1.0.0 and 14.1.2.0.0
Oracle WebLogic Server 15.1.1.0.0

Discovery Timeline

2026-07-21 - CVE-2026-60202 published to NVD following Oracle's July 2026 Critical Patch Update
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60202

Vulnerability Analysis

The vulnerability resides in the Core component of Oracle WebLogic Server. Oracle categorizes the issue as easily exploitable, requiring only network access to the T3 or IIOP listener ports. No credentials, user interaction, or prior foothold are needed to reach the vulnerable code path.

T3 is Oracle's proprietary remote method invocation protocol used by WebLogic clients and servers to exchange serialized Java objects. IIOP performs a similar role for CORBA interoperability. Both protocols have a long history of authentication and deserialization weaknesses that permit remote takeover when reachable from untrusted networks.

The underlying weakness maps to CWE-306: Missing Authentication for Critical Function. A privileged operation exposed through T3 or IIOP can be invoked without validating the identity of the caller, allowing attackers to execute server-side actions reserved for authenticated administrators.

Root Cause

The root cause is the absence of authentication enforcement on a critical function reachable through the T3 and IIOP protocol endpoints. Any client capable of reaching TCP port 7001 (or the configured T3/IIOP listener) can invoke the vulnerable operation and pivot to full server compromise.

Attack Vector

An attacker sends a crafted request over T3 or IIOP to the WebLogic listener. Because the operation does not verify the caller, the request is processed with server privileges. Refer to the Oracle Security Alert July 2026 for the official advisory and patch matrix.

Detection Methods for CVE-2026-60202

Indicators of Compromise

Unexpected inbound connections to WebLogic T3 or IIOP listener ports (default 7001, 7002) from untrusted networks.
New or modified files under the WebLogic domains/ directory, particularly deployed WAR/EAR archives or JSP files created outside change windows.
WebLogic Java processes spawning shells (cmd.exe, powershell.exe, /bin/sh, bash) or network utilities such as curl, wget, or nc.
Outbound connections from the WebLogic JVM to unknown external hosts, indicative of reverse shells or payload staging.

Detection Strategies

Inspect WebLogic access and server logs (AdminServer.log, access.log) for anomalous T3/IIOP client connections and deserialization errors.
Deploy network signatures that flag T3 protocol handshakes (t3://, t3s://) originating from outside the management network.
Correlate WebLogic process lineage with EDR telemetry to identify child processes that deviate from a normal Java application server baseline.

Monitoring Recommendations

Enable verbose logging on the T3 and IIOP channels and forward events to a centralized SIEM for retention and correlation.
Alert on any process created by java where the parent command line contains weblogic.Server and the child is a scripting or reconnaissance binary.
Monitor filesystem changes in $DOMAIN_HOME/servers/*/tmp/_WL_user/ for unauthorized application deployments.

How to Mitigate CVE-2026-60202

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all WebLogic Server instances running 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0.
Restrict network access to T3 and IIOP listener ports so only trusted management hosts can reach them.
Inventory external-facing WebLogic servers and prioritize internet-exposed instances for immediate patching.

Patch Information

Oracle released fixes for CVE-2026-60202 in the July 2026 Critical Patch Update. Administrators should consult the Oracle Security Alert July 2026 for exact patch identifiers and installation instructions for each affected release train.

Workarounds

Disable the T3 and IIOP protocols on public-facing managed servers if the protocols are not required by applications.
Configure WebLogic connection filters (weblogic.security.net.ConnectionFilterImpl) to deny T3 and IIOP traffic from untrusted sources.
Place WebLogic behind a reverse proxy or web application firewall that terminates only HTTP/HTTPS and blocks T3/IIOP.

bash

# Example WebLogic connection filter rules to block external T3/IIOP
# Set in the WebLogic Administration Console under:
# Domain -> Security -> Filter -> Connection Filter Rules

10.0.0.0/8    * * allow t3 t3s iiop iiops
127.0.0.1     * * allow t3 t3s iiop iiops
0.0.0.0/0     * * deny  t3 t3s iiop iiops