CVE-2026-60415: Oracle WebLogic Server RCE Vulnerability

CVE-2026-60415 Overview

CVE-2026-60415 is a vulnerability in the Core component of Oracle WebLogic Server, part of Oracle Fusion Middleware. An unauthenticated attacker with network access via the T3 or Internet Inter-ORB Protocol (IIOP) can compromise the server. Successful exploitation results in full takeover of Oracle WebLogic Server, impacting confidentiality, integrity, and availability. The flaw is classified under [CWE-200] (Information Exposure) and is difficult to exploit, but requires no user interaction or authentication. Affected versions include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle addressed the issue in an out-of-cycle security alert.

Critical Impact
Unauthenticated network attackers reaching T3 or IIOP endpoints can achieve complete takeover of Oracle WebLogic Server instances.

Affected Products

Oracle WebLogic Server 12.2.1.4.0
Oracle WebLogic Server 14.1.1.0.0
Oracle WebLogic Server 14.1.2.0.0
Oracle WebLogic Server 15.1.1.0.0

Discovery Timeline

2026-08-18 - CVE-2026-60415 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-60415

Vulnerability Analysis

The vulnerability resides in the Core component of Oracle WebLogic Server. The affected code paths are reachable through the T3 remote invocation protocol and IIOP, both of which are commonly exposed by default WebLogic deployments. An attacker sending crafted network traffic to these listeners can trigger conditions that lead to server compromise without prior authentication.

Oracle categorizes the flaw under [CWE-200], indicating exposure of sensitive information to an unauthorized actor as the underlying weakness. However, Oracle's advisory states successful exploitation results in complete takeover of the WebLogic Server instance, impacting confidentiality, integrity, and availability. This suggests the information disclosure primes subsequent stages of the attack chain that lead to full compromise.

Exploitation complexity is high, meaning attackers must satisfy conditions outside their direct control. This may include timing, environmental state, or the ability to observe responses from the target. Despite the complexity, the network attack vector and lack of required privileges make internet-exposed WebLogic instances viable targets.

Root Cause

The root cause is improper information exposure in the Core component when handling requests over T3 and IIOP. Both protocols support Java object serialization semantics, which have historically been the source of critical WebLogic vulnerabilities. Oracle has not published deeper technical details in the public advisory.

Attack Vector

The attack originates from the network. An unauthenticated adversary establishes a T3 or IIOP connection to the WebLogic listen port, typically TCP 7001 or 7002. The attacker submits crafted protocol messages that exercise the vulnerable code path in the Core component, culminating in server takeover.

No verified public exploit code is available. See the Oracle Security Alert for vendor guidance.

Detection Methods for CVE-2026-60415

Indicators of Compromise

Unexpected inbound TCP connections to WebLogic listen ports 7001 and 7002 from untrusted networks.
Anomalous T3 or IIOP protocol handshakes originating from external or non-application-tier hosts.
Creation of new administrative accounts, deployed applications, or scheduled tasks within WebLogic domains without change-control records.
Java process (java.exe or JVM) spawning shells, cmd.exe, powershell.exe, or /bin/sh from within the WebLogic domain directory.

Detection Strategies

Inspect WebLogic access logs and AdminServer.log for malformed T3 or IIOP requests and unauthenticated protocol errors.
Deploy network signatures that flag T3 (t3://, t3s://) traffic to WebLogic servers from unauthorized network segments.
Correlate JVM child-process creation events with WebLogic process identifiers to identify post-exploitation activity.

Monitoring Recommendations

Enable verbose auditing on WebLogic Server and forward logs to a centralized SIEM for retention and correlation.
Monitor egress from WebLogic hosts for outbound connections to unexpected destinations, which may indicate reverse shells or data exfiltration.
Track application deployments, MBean modifications, and configuration changes as high-fidelity signals of tampering.

How to Mitigate CVE-2026-60415

Immediate Actions Required

Apply the patches referenced in the Oracle Security Alert to all affected WebLogic Server versions.
Inventory internet-facing WebLogic instances and prioritize patching for those exposing T3 or IIOP.
Restrict access to T3 and IIOP listeners using network segmentation, firewall rules, and the WebLogic Connection Filter.

Patch Information

Oracle released fixes for CVE-2026-60415 as part of its security alert for versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Administrators should consult the Oracle Security Alert for patch identifiers, install order, and any prerequisite bundle patches. Test patches in non-production environments before rolling out to production domains.

Workarounds

Configure the WebLogic weblogic.security.net.ConnectionFilterImpl connection filter to deny T3 and IIOP traffic from untrusted sources.
Disable IIOP through the WebLogic Server Administration Console if the protocol is not required by applications.
Place WebLogic Server behind a reverse proxy or web application firewall that terminates only HTTP or HTTPS and blocks direct protocol access.

bash

# Example WebLogic connection filter rules (config.xml)
# Deny all external T3 and IIOP; allow only internal application tier
<connection-filter>weblogic.security.net.ConnectionFilterImpl</connection-filter>
<connection-filter-rule>10.0.0.0/8 * * allow t3 t3s iiop iiops</connection-filter-rule>
<connection-filter-rule>0.0.0.0/0 * * deny t3 t3s iiop iiops</connection-filter-rule>