CVE-2026-60312 Overview
CVE-2026-60312 is a network-exploitable vulnerability in the Core component of Oracle WebLogic Server, part of Oracle Fusion Middleware. The flaw allows an unauthenticated remote attacker to compromise the server through the T3 or IIOP protocols. Successful exploitation results in complete takeover of the WebLogic Server instance, impacting confidentiality, integrity, and availability.
Oracle rates the vulnerability with a CVSS 3.1 base score of 8.1. Attack complexity is high, but no authentication or user interaction is required. The issue is tracked under CWE-306: Missing Authentication for Critical Function.
Critical Impact
Unauthenticated attackers with network access to T3 or IIOP listeners can fully take over affected Oracle WebLogic Server instances.
Affected Products
- Oracle WebLogic Server 12.2.1.4.0
- Oracle WebLogic Server 14.1.1.0.0 and 14.1.2.0.0
- Oracle WebLogic Server 15.1.1.0.0
Discovery Timeline
- 2026-07-21 - CVE-2026-60312 published to NVD
- 2026-07-23 - Last updated in NVD database
Technical Details for CVE-2026-60312
Vulnerability Analysis
The vulnerability resides in the Core component of Oracle WebLogic Server. An unauthenticated attacker with network reachability to the T3 or Internet Inter-ORB Protocol (IIOP) listeners can send crafted requests that bypass authentication controls. Successful exploitation grants the attacker control over the WebLogic Server process.
The T3 protocol is WebLogic's proprietary Remote Method Invocation (RMI) transport, and IIOP is the CORBA-based equivalent. Both protocols have a long history of exposing WebLogic servers to unauthenticated attacks when reachable from untrusted networks. This flaw continues that pattern by allowing takeover through the same channels.
Oracle classifies exploitation as difficult, reflected in the high attack complexity rating. However, the impact is total: attackers gain the ability to read, modify, and disrupt any data or service handled by the WebLogic instance.
The EPSS probability score for this CVE is 0.238% as of 2026-07-23, indicating low observed exploitation activity at the time of publication.
Root Cause
The underlying weakness is CWE-306: Missing Authentication for Critical Function. The Core component exposes functionality reachable through T3 and IIOP without enforcing authentication before processing sensitive operations. Attackers can invoke these operations directly, leading to server compromise.
Attack Vector
Exploitation requires network access to the T3 or IIOP listener ports on a vulnerable WebLogic Server. No credentials or user interaction are required. An attacker crafts protocol-level requests that invoke privileged functionality in the Core component, resulting in full compromise. Refer to the Oracle Critical Patch Update Advisory - July 2026 for vendor technical details.
Detection Methods for CVE-2026-60312
Indicators of Compromise
- Unexpected inbound connections to WebLogic T3 (default TCP 7001) or IIOP listener ports from untrusted sources.
- New or modified Java processes spawned by the WebLogic managed server, including unexpected java child processes executing shell commands.
- Unusual outbound traffic from the WebLogic host to attacker-controlled infrastructure following T3 or IIOP sessions.
- Modifications to WebLogic domain configuration files, deployment directories, or new unauthorized web application deployments.
Detection Strategies
- Monitor WebLogic access and server logs for anomalous T3 and IIOP handshake activity, especially from external network ranges.
- Deploy network-layer inspection to flag T3 and IIOP traffic reaching WebLogic listeners from outside authorized management networks.
- Correlate authentication failures and protocol errors on WebLogic listener ports with process creation events on the host.
Monitoring Recommendations
- Alert on any WebLogic managed server spawning interpreters or shells such as cmd.exe, powershell.exe, /bin/sh, or /bin/bash.
- Track outbound network connections initiated by the WebLogic JVM process to unusual destinations or ports.
- Continuously monitor WebLogic domain directories for unauthorized .war, .ear, or .jsp file creation.
How to Mitigate CVE-2026-60312
Immediate Actions Required
- Apply the Oracle Critical Patch Update from July 2026 to all affected WebLogic Server versions without delay.
- Restrict T3 and IIOP listener access to trusted management networks using network segmentation and host firewalls.
- Inventory all WebLogic Server instances in the environment and confirm patch status against versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
Patch Information
Oracle addressed CVE-2026-60312 in the July 2026 Critical Patch Update. Administrators should download and apply the applicable patches from the Oracle Security Alert - July 2026 advisory. Patches are available for versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
Workarounds
- Disable the T3 and IIOP protocols on WebLogic managed servers if they are not required by applications.
- Configure WebLogic connection filters (weblogic.security.net.ConnectionFilterImpl) to deny T3 and IIOP traffic from untrusted sources.
- Place WebLogic administration interfaces behind a VPN or bastion host to eliminate direct exposure to the internet.
# Example WebLogic connection filter rule to restrict T3/IIOP
# Set in the WebLogic Admin Console: Domain > Security > Filter
# Rule format: target localAddress localPort action protocols
* 10.0.0.0/8 7001 allow t3 t3s iiop iiops
* * 7001 deny t3 t3s iiop iiops
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
