CVE-2026-60313: Oracle WebLogic Server RCE Vulnerability

CVE-2026-60313 Overview

CVE-2026-60313 is a high-severity vulnerability in Oracle WebLogic Server, a component of Oracle Fusion Middleware. The flaw resides in the Core component and is exploitable over the network through Remote Method Invocation (RMI). A low-privileged attacker with network access can compromise the server without user interaction. Successful exploitation results in full takeover of the WebLogic Server, impacting confidentiality, integrity, and availability. The vulnerability is categorized under CWE-306: Missing Authentication for Critical Function.

Critical Impact
Successful attacks result in complete takeover of Oracle WebLogic Server, exposing hosted applications, credentials, and downstream data stores to compromise.

Affected Products

Oracle WebLogic Server 12.2.1.4.0
Oracle WebLogic Server 14.1.1.0.0 and 14.1.2.0.0
Oracle WebLogic Server 15.1.1.0.0

Discovery Timeline

2026-07-21 - CVE-2026-60313 published to NVD following the Oracle Critical Patch Update July 2026
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60313

Vulnerability Analysis

The vulnerability affects the Core component of Oracle WebLogic Server and is reachable over the RMI protocol. Oracle rates the issue as easily exploitable, requiring only network access and low-level privileges to trigger. There is no user interaction required, and the scope remains unchanged, but the impact spans all three CIA properties at a high level. The current EPSS probability sits at 0.266%, reflecting limited public exploitation activity at the time of publication.

Root Cause

The underlying weakness is classified as CWE-306: Missing Authentication for Critical Function. A critical operation exposed through the RMI interface fails to enforce sufficient authentication controls. This allows a low-privileged user to invoke server-side functionality that should be restricted to trusted administrative contexts. The result is an authorization gap between the RMI listener and the underlying WebLogic Core routines.

Attack Vector

Exploitation occurs over the network by sending crafted RMI requests to an exposed WebLogic Server listener. The attacker must hold low-level credentials but does not require administrative access or user interaction. Because RMI is often exposed for inter-service communication, WebLogic deployments that publish RMI ports to broad network segments carry the highest exposure. See the Oracle Critical Patch Update July 2026 advisory for vendor guidance on affected code paths.

No verified public exploit code is currently available for CVE-2026-60313. Historically, WebLogic RMI vulnerabilities have been chained with deserialization gadgets to achieve remote code execution, so defenders should assume weaponization is feasible.

Detection Methods for CVE-2026-60313

Indicators of Compromise

Unexpected inbound RMI connections (default ports 7001/7002) from untrusted networks or non-application sources.
Anomalous child processes spawned by the WebLogic Java process, such as shells, curl, wget, or scripting interpreters.
Newly deployed or modified WAR/EAR artifacts and JSP files in the WebLogic domain directory outside of change windows.

Detection Strategies

Inspect WebLogic access and audit logs for RMI invocations tied to low-privileged accounts targeting administrative or core service endpoints.
Deploy network monitoring to identify Java serialized object patterns (AC ED 00 05) inside RMI traffic destined for WebLogic listeners.
Correlate authentication events with subsequent process creations on the WebLogic host to surface post-exploitation activity.

Monitoring Recommendations

Enable verbose WebLogic auditing on the Core and RMI subsystems, forwarding events to a centralized SIEM for retention and correlation.
Alert on outbound connections initiated by the WebLogic JVM to unusual destinations, which often indicate reverse-shell or staging behavior.
Track file integrity on the $DOMAIN_HOME directory to identify tampering with configuration, deployment, or credential stores.

How to Mitigate CVE-2026-60313

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all affected WebLogic Server instances as the primary remediation.
Restrict RMI listener exposure to trusted management networks using firewalls, network segmentation, or reverse proxies.
Audit WebLogic accounts and revoke unnecessary low-privileged access that could be leveraged to reach the vulnerable RMI paths.

Patch Information

Oracle addressed CVE-2026-60313 in the Oracle Critical Patch Update July 2026. Administrators should upgrade or patch versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 to the fixed releases identified in the advisory. Validate the patch level using WLST or the Administration Console after deployment.

Workarounds

Filter access to the WebLogic RMI ports at the perimeter and internal firewalls until patching is complete.
Disable or block the T3 and T3s protocols on public-facing channels using WebLogic connection filters where RMI is not required.
Enforce mutual TLS or IP allow-lists on management interfaces to reduce the population of accounts that can reach the vulnerable code path.

bash

# Example WebLogic connection filter to restrict T3/T3s and IIOP to trusted subnets
# Set in Administration Console: Domain > Security > Filter
weblogic.security.net.ConnectionFilterImpl
10.10.0.0/16 * * allow t3 t3s iiop iiops
0.0.0.0/0    * * deny  t3 t3s iiop iiops