CVE-2026-60292: Oracle WebLogic Server RCE Vulnerability

CVE-2026-60292 Overview

CVE-2026-60292 is a critical vulnerability in the Core component of Oracle WebLogic Server, part of the Oracle Fusion Middleware suite. The flaw allows an unauthenticated remote attacker with network access via HTTP to fully compromise the affected server. Supported versions 12.2.1.4.0 and 14.1.1.0.0 are affected. Successful exploitation results in complete takeover of the WebLogic Server instance, impacting confidentiality, integrity, and availability. Oracle addressed the issue in the Oracle Security Alert July 2026.

Critical Impact
Unauthenticated remote attackers can take full control of Oracle WebLogic Server over HTTP, enabling arbitrary code execution and complete host compromise.

Affected Products

Oracle WebLogic Server 12.2.1.4.0
Oracle WebLogic Server 14.1.1.0.0
Oracle Fusion Middleware deployments embedding these WebLogic versions

Discovery Timeline

2026-07-21 - CVE-2026-60292 published to the National Vulnerability Database
2026-07-23 - Entry last modified in NVD

Technical Details for CVE-2026-60292

Vulnerability Analysis

The vulnerability resides in the Core component of Oracle WebLogic Server. An unauthenticated attacker can reach the vulnerable code path over HTTP without user interaction. Oracle's advisory describes the flaw as easily exploitable, and successful attacks result in full server takeover. The scope covers all three security properties, meaning attackers can read sensitive data, alter application state, and disrupt service availability. Because WebLogic frequently fronts business-critical Java EE applications, compromise typically extends to backend databases, message queues, and integrated identity systems.

Root Cause

Oracle has not published detailed root-cause information beyond identifying the Core component as the source of the flaw. Historically, critical unauthenticated WebLogic vulnerabilities in the Core component have stemmed from insecure deserialization in T3, IIOP, or HTTP handlers, or from authentication bypasses in built-in servlets. Administrators should treat this class of issue as consistent with prior Core-component RCE patterns until Oracle releases further technical detail.

Attack Vector

Exploitation requires only network reachability to the WebLogic HTTP listener. No credentials, prior access, or user interaction are needed. An attacker sends a crafted HTTP request to an exposed WebLogic endpoint and gains code execution in the context of the WebLogic process. Internet-facing WebLogic administration consoles and application ports are the highest-risk exposures. The EPSS probability at publication is 0.522% (percentile 41.146), which is expected to rise once public exploit code emerges.

No verified proof-of-concept code is publicly available at this time. See the Oracle Security Alert July 2026 for vendor-supplied technical details.

Detection Methods for CVE-2026-60292

Indicators of Compromise

Unexpected child processes spawned by the WebLogic java process, particularly shells, curl, wget, or scripting interpreters.
New or modified files under the WebLogic domain directory, servers/<name>/tmp, or deployed application directories.
Outbound network connections from the WebLogic host to unfamiliar external IPs shortly after inbound HTTP bursts.
HTTP requests to WebLogic endpoints containing serialized Java payloads, unusual Content-Type headers, or long encoded bodies.

Detection Strategies

Inspect WebLogic access.log and server.log for anomalous POST requests to administrative or internal servlets from untrusted sources.
Alert on WebLogic JVM spawning operating system commands, a behavior rarely seen in normal application workloads.
Correlate HTTP request patterns with process and file system telemetry to identify post-exploitation staging.

Monitoring Recommendations

Enable verbose HTTP request logging on WebLogic managed servers and forward logs to a centralized analytics platform.
Monitor for new listener sockets, cron entries, or scheduled tasks created under the WebLogic service account.
Track integrity of config.xml, deployment plans, and .war or .ear archives within the domain.

How to Mitigate CVE-2026-60292

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all WebLogic 12.2.1.4.0 and 14.1.1.0.0 deployments without delay.
Restrict network access to WebLogic HTTP, T3, and IIOP ports so only trusted management networks can reach them.
Audit WebLogic hosts for signs of prior compromise before and after patching, since patching alone does not evict an established attacker.

Patch Information

Oracle released fixes as part of the July 2026 Critical Patch Update. Administrators must obtain and apply the WebLogic-specific patches referenced in the Oracle Security Alert July 2026. Verify patch level after installation using opatch lsinventory and validate that domain restarts pick up the updated binaries.

Workarounds

Place WebLogic administration interfaces behind a VPN or bastion and block direct internet exposure at the perimeter.
Use a web application firewall to inspect and drop suspicious serialized Java payloads and oversized request bodies targeting WebLogic endpoints.
Disable unused WebLogic protocols and servlets, including the T3 protocol filter, to reduce the reachable attack surface until patches are applied.

bash

# Example WebLogic connection filter to restrict T3/IIOP to internal ranges
# Set in WebLogic Admin Console: Domain > Security > Filter
# Connection Filter: weblogic.security.net.ConnectionFilterImpl
# Rules (allow internal, deny all others):
10.0.0.0/8 * * allow t3 t3s http https iiop iiops
192.168.0.0/16 * * allow t3 t3s http https iiop iiops
0.0.0.0/0 * * deny t3 t3s iiop iiops