CVE-2026-60294: Oracle WebLogic Server RCE Vulnerability

CVE-2026-60294 Overview

CVE-2026-60294 is a critical vulnerability in the Core component of Oracle WebLogic Server, part of Oracle Fusion Middleware. An unauthenticated remote attacker with network access via Simple Object Access Protocol (SOAP) can compromise the server and achieve full takeover. The flaw affects supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle addressed the issue in the July 2026 Critical Patch Update.

Critical Impact
Unauthenticated attackers can remotely take over Oracle WebLogic Server instances exposed over the network via SOAP, resulting in complete loss of confidentiality, integrity, and availability.

Affected Products

Oracle WebLogic Server 12.2.1.4.0
Oracle WebLogic Server 14.1.1.0.0
Oracle WebLogic Server 14.1.2.0.0
Oracle WebLogic Server 15.1.1.0.0

Discovery Timeline

2026-07-21 - CVE-2026-60294 published to the National Vulnerability Database (NVD)
2026-07-23 - Entry last modified in NVD database
July 2026 - Oracle releases fix in the Oracle Critical Patch Update Advisory - July 2026

Technical Details for CVE-2026-60294

Vulnerability Analysis

CVE-2026-60294 resides in the Core component of Oracle WebLogic Server. The flaw is reachable through the SOAP protocol and requires no authentication or user interaction. A remote attacker can send crafted SOAP requests over the network to trigger the condition and gain full control of the target instance.

Successful exploitation results in complete server takeover. Attackers can execute arbitrary operations, read or modify sensitive application data, deploy malicious applications, and pivot to backend systems reachable from the WebLogic host. The Exploit Prediction Scoring System (EPSS) currently rates the probability at 0.522% (percentile 41.148) as of 2026-07-23, though this score typically rises after weaponized proof-of-concept code appears.

Root Cause

Oracle has not published detailed technical internals in the public advisory. Historically, WebLogic Core SOAP vulnerabilities of this class have stemmed from insecure deserialization of untrusted Java objects transmitted inside SOAP envelopes, or from parser flaws in the T3/IIOP-adjacent SOAP handlers. The absence of authentication requirements suggests the vulnerable code path is exposed on the default management or application listen ports.

Attack Vector

The attack vector is network-based over SOAP. An attacker delivers a crafted SOAP request to an internet-exposed or internally reachable WebLogic listener. Because authentication is not required and the attack complexity is low, exploitation is feasible using automated scanners once technical details or proof-of-concept code become public. Refer to the Oracle Security Advisory July 2026 for vendor guidance.

No verified public proof-of-concept code is currently available. See the vendor advisory for authoritative technical detail.

Detection Methods for CVE-2026-60294

Indicators of Compromise

Unexpected SOAP requests to WebLogic listen ports (commonly 7001, 7002) originating from untrusted networks or containing serialized Java payload signatures.
New or modified .war, .ear, or JSP files under WebLogic domain directories that do not correspond to authorized deployments.
Spawning of child processes such as cmd.exe, powershell.exe, /bin/sh, or curl/wget from the WebLogic Java process.
Outbound network connections from the WebLogic host to unfamiliar external hosts, indicative of reverse shells or second-stage tooling.

Detection Strategies

Inspect WebLogic access.log and server logs for anomalous SOAP endpoints, oversized request bodies, or repeated 500-class errors from unauthenticated sources.
Deploy network intrusion detection signatures that flag serialized Java magic bytes (aced 0005) or suspicious XML content inside SOAP envelopes to WebLogic hosts.
Correlate authentication logs with process execution telemetry to identify code execution originating from the WebLogic JVM without preceding administrative login.

Monitoring Recommendations

Continuously monitor Java process lineage on WebLogic hosts for shell or scripting-engine child processes.
Alert on modifications to deployment staging directories and startup.sh/setDomainEnv.sh files.
Baseline outbound connections from WebLogic servers and alert on new destinations, particularly to cloud metadata services or previously unseen IPs.

How to Mitigate CVE-2026-60294

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all affected WebLogic Server instances without delay.
Inventory all Oracle Fusion Middleware deployments and confirm patch level for versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
Restrict network exposure of WebLogic administrative and SOAP listen ports to trusted management networks only.
Review WebLogic hosts for indicators of compromise dating back to the patch release, given the low complexity of exploitation.

Patch Information

Oracle has issued fixes in the Oracle Critical Patch Update Advisory - July 2026. Administrators must apply the WebLogic Server patches corresponding to their specific version. Oracle recommends applying Critical Patch Updates as soon as possible and warns that unsupported versions may also be affected.

Workarounds

If patching cannot be performed immediately, block external access to WebLogic listen ports (default 7001 and 7002) at the network perimeter and internal firewalls.
Disable or filter SOAP endpoints that are not required for business operations using a reverse proxy or web application firewall rule set.
Enforce network segmentation so that WebLogic servers cannot initiate outbound connections to the internet except through inspected proxies.

bash

# Example: restrict WebLogic listen ports to a trusted management subnet using iptables
iptables -A INPUT -p tcp --dport 7001 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7002 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7001 -j DROP
iptables -A INPUT -p tcp --dport 7002 -j DROP