CVE-2026-60529: Oracle WebLogic Server RCE Vulnerability

CVE-2026-60529 Overview

CVE-2026-60529 is a high-severity vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware. The flaw resides in the Console component and affects supported versions 14.1.2.0.0 and 15.1.1.0.0. An authenticated attacker with high privileges and network access via HTTP can exploit this weakness to compromise Oracle WebLogic Server. Successful exploitation results in full takeover of the server, impacting confidentiality, integrity, and availability. Oracle addressed the issue in the July 2026 Critical Patch Update.

Critical Impact
Successful exploitation grants complete takeover of the Oracle WebLogic Server, exposing hosted applications, credentials, and backend data.

Affected Products

Oracle WebLogic Server 14.1.2.0.0
Oracle WebLogic Server 15.1.1.0.0
Oracle Fusion Middleware deployments using the WebLogic Console component

Discovery Timeline

2026-07-21 - CVE CVE-2026-60529 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Oracle releases fix in the Oracle Critical Patch Update Advisory - July 2026

Technical Details for CVE-2026-60529

Vulnerability Analysis

The vulnerability exists in the administrative Console component of Oracle WebLogic Server. According to Oracle's advisory, the flaw is easily exploitable but requires an attacker to already hold high privileges within the WebLogic environment. Once authenticated, the attacker sends crafted HTTP requests to Console endpoints to escalate their control over the server process. The result is a full compromise of confidentiality, integrity, and availability on the target host.

Because WebLogic often runs middleware for business-critical Java EE applications, a takeover exposes deployed applications, JDBC connection credentials, JMS queues, and any secrets stored in the domain configuration. Attackers can pivot from a compromised WebLogic instance into backend databases and internal services.

Root Cause

Oracle has not published root-cause details beyond the affected component. The issue is scoped to the WebLogic Console administrative interface and manifests over HTTP. Refer to the Oracle Security Alert - July 2026 for vendor-supplied technical context.

Attack Vector

The attack vector is network-based over HTTP. The attacker must authenticate with high privileges before exploitation, meaning the flaw is most relevant in scenarios involving compromised administrator credentials, insider threats, or chained exploitation following an earlier authentication bypass. User interaction is not required, and the attack complexity is low.

No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.465% at the 37.7 percentile.

Detection Methods for CVE-2026-60529

Indicators of Compromise

Unexpected authenticated sessions to /console/ or /console-help/ paths from unusual source addresses
Creation of new WebLogic administrative users or modification of existing role assignments
Deployment of unfamiliar WAR, EAR, or JAR artifacts through the Console
Outbound network connections initiated by the WebLogic JVM to attacker-controlled infrastructure

Detection Strategies

Enable WebLogic audit logging and forward AdminServer.log and access.log events to a central log platform for correlation
Alert on Console logins outside approved administrator source IP ranges or maintenance windows
Monitor for administrative operations such as user creation, MBean invocations, and application deployments performed via HTTP

Monitoring Recommendations

Baseline normal administrator activity and flag deviations in request volume or endpoint access patterns
Track child processes spawned by the WebLogic Java process, particularly shells or scripting interpreters
Review file system changes under the WebLogic domain directory and servers/AdminServer/tmp for unauthorized artifacts

How to Mitigate CVE-2026-60529

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to WebLogic Server versions 14.1.2.0.0 and 15.1.1.0.0
Restrict network access to the WebLogic administrative Console to trusted management networks only
Rotate credentials for all high-privileged WebLogic administrator accounts
Audit recent Console activity for signs of unauthorized administrative actions

Patch Information

Oracle addressed CVE-2026-60529 in the July 2026 Critical Patch Update. Administrators should follow guidance in the Oracle Security Alert - July 2026 and apply the appropriate patch bundle for their WebLogic version. Restart the affected servers after patch installation to ensure the fix is loaded.

Workarounds

Segment the WebLogic administrative Console behind a jump host or VPN, blocking direct HTTP access from user networks
Enforce multi-factor authentication for all WebLogic administrator accounts through an upstream identity provider
Disable or firewall the Console on production servers where administration is performed via WLST or automation
Apply least-privilege role assignments to reduce the number of accounts able to reach the vulnerable code path

bash

# Configuration example: restrict Console access at the network layer
iptables -A INPUT -p tcp --dport 7001 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7001 -j DROP