CVE-2026-60291: Oracle WebLogic Server RCE Vulnerability

CVE-2026-60291 Overview

CVE-2026-60291 is a critical remote code execution vulnerability affecting the Core component of Oracle WebLogic Server, part of Oracle Fusion Middleware. The flaw allows an unauthenticated attacker with network access via HTTP to compromise the server and achieve full takeover. Oracle disclosed the issue in the Oracle Security Alert July 2026. Affected versions include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The vulnerability requires no user interaction and no privileges, making it a high-priority patching target for organizations running WebLogic in production or internet-facing deployments.

Critical Impact
An unauthenticated remote attacker can achieve complete confidentiality, integrity, and availability compromise of Oracle WebLogic Server over HTTP.

Affected Products

Oracle WebLogic Server 12.2.1.4.0
Oracle WebLogic Server 14.1.1.0.0
Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0

Discovery Timeline

2026-07-21 - CVE CVE-2026-60291 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60291

Vulnerability Analysis

The vulnerability resides in the Core component of Oracle WebLogic Server. Oracle classifies the flaw as easily exploitable by an unauthenticated attacker over HTTP. Successful exploitation results in full takeover of the WebLogic Server instance, granting the attacker control over the underlying application server process and any hosted enterprise applications.

Historically, WebLogic Core vulnerabilities of this class have stemmed from unsafe deserialization of untrusted data delivered through protocols such as T3, IIOP, or HTTP request bodies handled by the server's internal handlers. Attackers craft serialized Java objects that trigger arbitrary method invocation during deserialization, leading to remote code execution under the WebLogic process account.

Oracle has not publicly released technical specifics beyond the advisory. Refer to the Oracle Security Alert July 2026 for authoritative details.

Root Cause

Oracle's advisory identifies the Core component as the vulnerable subsystem. The unauthenticated network attack vector combined with high impact across confidentiality, integrity, and availability indicates a flaw in request processing that bypasses authentication and reaches privileged execution paths.

Attack Vector

The attack occurs over HTTP against a network-reachable WebLogic Server. No credentials or user interaction are required. An attacker sends a crafted HTTP request to the WebLogic listener and triggers the vulnerable code path, resulting in server takeover.

No public proof-of-concept code has been verified at the time of this writing. The EPSS score is 0.522% (41st percentile). See the Oracle Security Alert July 2026 for vendor guidance.

Detection Methods for CVE-2026-60291

Indicators of Compromise

Unexpected child processes spawned by the WebLogic Java process (java.exe or java), such as shells, cmd.exe, powershell.exe, bash, or curl/wget invocations.
New or modified files in WebLogic deployment directories, including unexpected .jsp, .war, or webshell artifacts under servers/<name>/tmp/_WL_internal/.
Outbound network connections initiated by the WebLogic process to unfamiliar hosts, particularly to command-and-control or file-staging infrastructure.

Detection Strategies

Inspect HTTP access logs for anomalous POST requests to WebLogic administrative or management URIs with large or binary payloads.
Monitor Java process behavior for deserialization-related exceptions logged in AdminServer.log and correlate with subsequent process activity.
Apply behavioral endpoint identification rules that flag Java application servers spawning interactive shells or scripting interpreters.

Monitoring Recommendations

Forward WebLogic server logs, HTTP access logs, and host process telemetry to a centralized analytics platform for correlation.
Establish alerts on new listener bindings, new deployed applications, and modifications to WebLogic configuration files such as config.xml.
Baseline outbound connections from application server hosts and alert on deviations.

How to Mitigate CVE-2026-60291

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all affected WebLogic Server versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) without delay.
Restrict network exposure of WebLogic HTTP listeners to trusted management networks using firewalls or reverse proxies.
Audit WebLogic hosts for signs of prior exploitation, including unexpected deployments, scheduled tasks, or persistence mechanisms.

Patch Information

Oracle released fixes as part of the July 2026 Critical Patch Update. Administrators should download and apply the patches referenced in the Oracle Security Alert July 2026 for each affected WebLogic Server version.

Workarounds

Block external access to WebLogic HTTP and administration ports at the network perimeter until patches are applied.
Disable unused WebLogic protocols and internal listeners that are not required for business operations.
Enforce web application firewall rules to inspect and filter suspicious payloads targeting WebLogic endpoints.

bash

# Example: restrict WebLogic listener to internal network via iptables
iptables -A INPUT -p tcp --dport 7001 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 7001 -j DROP