CVE-2026-60205: Oracle WebLogic Server RCE Vulnerability

CVE-2026-60205 Overview

CVE-2026-60205 is a critical vulnerability in the Core component of Oracle WebLogic Server, part of Oracle Fusion Middleware. The flaw allows an unauthenticated attacker with network access via TCP to fully compromise the server. Oracle documented the issue in the Oracle Security Alert July 2026.

The weakness is classified as Missing Authentication for Critical Function [CWE-306]. Successful exploitation results in complete takeover of the WebLogic instance, impacting confidentiality, integrity, and availability. Affected supported releases are 12.2.1.4.0 and 14.1.2.0.0.

Critical Impact
Unauthenticated remote attackers can take over Oracle WebLogic Server instances reachable over the network, leading to full compromise of hosted applications and data.

Affected Products

Oracle WebLogic Server 12.2.1.4.0
Oracle WebLogic Server 14.1.2.0.0
Oracle Fusion Middleware deployments embedding the affected WebLogic Core component

Discovery Timeline

2026-07-21 - CVE-2026-60205 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60205

Vulnerability Analysis

The vulnerability resides in the Core component of Oracle WebLogic Server. According to Oracle, the flaw is easily exploitable and requires no authentication, no user interaction, and no elevated privileges. An attacker only needs network reachability to the WebLogic TCP listener.

Oracle indicates that successful attacks result in takeover of the WebLogic Server. This means an attacker can execute code or perform administrative actions in the context of the WebLogic process. Hosted Java EE applications, credentials, and backend integrations become exposed as a result.

The EPSS score is 0.522% with a percentile of 41.147 as of 2026-07-23, indicating measurable but not yet widespread exploitation prediction. Oracle WebLogic Core flaws with these characteristics have historically been abused through deserialization and protocol-level authentication bypass paths.

Root Cause

The issue maps to [CWE-306] Missing Authentication for Critical Function. A privileged operation in the WebLogic Core is reachable without validating the identity of the caller. This design gap allows anonymous network clients to invoke functionality that should be restricted to authenticated administrators.

Attack Vector

The attack vector is network-based over TCP against a WebLogic listener port such as the default 7001 or configured administrative channels. An attacker sends crafted requests to the exposed service to trigger the unauthenticated code path. No prior foothold, credentials, or user interaction are required.

No public proof-of-concept exploit was available at the time of publication. Refer to the Oracle Security Alert July 2026 for authoritative technical details.

Detection Methods for CVE-2026-60205

Indicators of Compromise

Unexpected child processes spawned by the WebLogic Java process, such as shells, cmd.exe, powershell.exe, or scripting interpreters.
New or modified files under WebLogic domain directories, especially unauthorized .war, .jsp, or webshell artifacts in servers/*/tmp/_WL_internal and servers/*/stage.
Outbound network connections from the WebLogic host to unfamiliar external IPs immediately following inbound requests to WebLogic TCP ports.
Anomalous authentication or configuration changes in config.xml and administrative user stores.

Detection Strategies

Inspect WebLogic access and server logs for unauthenticated requests to administrative or T3/IIOP endpoints followed by successful privileged actions.
Alert on Java process (java, beasvc) executing OS commands or writing executables to disk.
Correlate inbound traffic to TCP 7001/7002 from untrusted networks with immediately following outbound connections from the same host.

Monitoring Recommendations

Forward WebLogic domain, access, and audit logs to a centralized SIEM for correlation and retention.
Baseline expected administrative activity and alert on deviations, particularly deployments outside change windows.
Monitor egress from application servers with default-deny policies to catch command-and-control activity early.

How to Mitigate CVE-2026-60205

Immediate Actions Required

Apply the Oracle Critical Patch Update referenced in the Oracle Security Alert July 2026 to all affected WebLogic Server instances.
Inventory WebLogic 12.2.1.4.0 and 14.1.2.0.0 deployments, including embedded instances in Fusion Middleware stacks.
Restrict network exposure of WebLogic administrative and T3/IIOP ports to trusted management networks only.
Review WebLogic hosts for signs of prior exploitation, focusing on unexpected deployments and process lineage.

Patch Information

Oracle addressed CVE-2026-60205 in the July 2026 Critical Patch Update. Administrators should download the applicable patches for Oracle WebLogic Server 12.2.1.4.0 and 14.1.2.0.0 from My Oracle Support and apply them following Oracle's documented procedures. Consult the Oracle Security Alert July 2026 for the authoritative patch matrix.

Workarounds

Block external access to WebLogic TCP listener ports at perimeter and host firewalls until patches are applied.
Disable the T3 and T3s protocols on internet-facing channels using WebLogic connection filters (weblogic.security.net.ConnectionFilterImpl).
Place WebLogic behind an authenticated reverse proxy or web application firewall that terminates and inspects traffic.
Isolate WebLogic hosts in dedicated network segments with strict egress filtering.

bash

# Example WebLogic connection filter rules to restrict T3/IIOP to a management subnet
# Set in the WebLogic Admin Console: Security > Filter
# Connection Filter: weblogic.security.net.ConnectionFilterImpl
# Connection Filter Rules:
10.0.10.0/24 * * allow t3 t3s iiop iiops
0.0.0.0/0    * * deny  t3 t3s iiop iiops