CVE-2026-60204: Oracle WebLogic Server RCE Vulnerability

CVE-2026-60204 Overview

CVE-2026-60204 is a critical vulnerability in the Core component of Oracle WebLogic Server, part of Oracle Fusion Middleware. The flaw allows an unauthenticated remote attacker with network access to the T3 or IIOP protocols to fully compromise the server. Affected versions include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The weakness is classified as Missing Authentication for Critical Function [CWE-306]. Oracle addressed the issue in the July 2026 Critical Patch Update.

Critical Impact
An unauthenticated attacker reachable over the network can take over Oracle WebLogic Server, resulting in full loss of confidentiality, integrity, and availability.

Affected Products

Oracle WebLogic Server 12.2.1.4.0
Oracle WebLogic Server 14.1.1.0.0
Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0

Discovery Timeline

2026-07-21 - CVE-2026-60204 published to NVD
2026-07-23 - Last updated in NVD database
July 2026 - Oracle publishes fix in the Oracle Critical Patch Update Advisory - July 2026

Technical Details for CVE-2026-60204

Vulnerability Analysis

The vulnerability resides in the Core component of Oracle WebLogic Server. It is reachable via the T3 and IIOP remote protocols that WebLogic uses for inter-server communication and RMI calls. An unauthenticated attacker who can send crafted requests over these protocols can compromise the server without user interaction.

Oracle categorizes the issue as easily exploitable with network attack surface and no privileges required. Successful exploitation results in complete takeover of the WebLogic Server, giving the attacker the same rights as the WebLogic process account. This class of flaw historically enables deployment of web shells, lateral movement into backing databases, and pivoting into internal networks.

The EPSS score is 0.522% at the 41.1 percentile as of 2026-07-23, reflecting early-stage exploitation likelihood that typically rises after public analysis of Oracle CPU fixes.

Root Cause

The underlying weakness is Missing Authentication for Critical Function [CWE-306]. Sensitive server operations exposed through the T3 and IIOP listeners can be invoked without valid credentials. WebLogic's history of T3/IIOP issues typically involves deserialization of untrusted objects reaching privileged handlers before authentication is enforced.

Attack Vector

Exploitation requires only network reachability to a WebLogic listener that accepts T3, T3s, IIOP, or IIOPs traffic. The attacker sends a crafted protocol handshake and payload to the listen port (commonly 7001 or 7002). No credentials, user interaction, or prior foothold is required, and the attack complexity is low. See the Oracle Security Alert - July 2026 for the fixed versions and full component metadata.

Detection Methods for CVE-2026-60204

Indicators of Compromise

Unexpected inbound connections to WebLogic T3 (7001) or IIOP (7002) ports from untrusted networks.
New or modified files under the WebLogic domain directory, especially JSP or WAR files written by the WebLogic process user.
Child processes spawned by java running WebLogic that launch shells, cmd.exe, powershell.exe, bash, or curl/wget.
Outbound connections from the WebLogic host to unknown IPs shortly after inbound T3/IIOP traffic.

Detection Strategies

Inspect WebLogic access.log and server logs for anomalous T3 protocol handshakes or malformed IIOP requests.
Correlate network telemetry for T3/IIOP traffic originating outside expected application tiers.
Hunt for Java-spawned process trees invoking OS shells, a common signature of WebLogic post-exploitation.

Monitoring Recommendations

Enable verbose logging on WebLogic listeners and forward logs to a centralized SIEM or data lake.
Alert on any process execution where the parent is the WebLogic JVM and the child is an interpreter or download utility.
Monitor filesystem changes to servers/*/tmp/_WL_internal/ and application deployment directories.

How to Mitigate CVE-2026-60204

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update for Oracle WebLogic Server to all affected versions immediately.
Restrict network access to T3 and IIOP listener ports to trusted management networks only.
Inventory all internet-exposed WebLogic instances and treat any exposed host as potentially compromised until forensic review completes.

Patch Information

Oracle released fixes for Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 in the Oracle Critical Patch Update Advisory - July 2026. Apply the patch matched to your specific WebLogic release and restart the affected managed servers.

Workarounds

Disable the T3 and IIOP protocols on public-facing WebLogic listeners if they are not required for application function.
Use WebLogic Connection Filters (weblogic.security.net.ConnectionFilterImpl) to restrict T3/IIOP connections to specific source addresses.
Place WebLogic administrative interfaces behind a VPN or bastion host and block port 7001/7002 at the perimeter firewall.

bash

# Example WebLogic connection filter rule (set via Admin Console -> Security)
# Deny all T3/T3s/IIOP/IIOPs traffic except from trusted subnet 10.0.0.0/8
10.0.0.0/8 * * allow t3 t3s iiop iiops
0.0.0.0/0 * * deny  t3 t3s iiop iiops