CVE-2026-60672: Oracle WebLogic Server RCE Vulnerability

CVE-2026-60672 Overview

CVE-2026-60672 is a critical vulnerability in the Core component of Oracle WebLogic Server, part of Oracle Fusion Middleware. Affected versions include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. An unauthenticated attacker with network access via the T3 or IIOP protocols can compromise the server without user interaction. Successful exploitation results in full takeover of the WebLogic Server instance, impacting confidentiality, integrity, and availability. The weakness is classified as Missing Authentication for Critical Function [CWE-306].

Critical Impact
Unauthenticated remote attackers can achieve complete takeover of Oracle WebLogic Server through exposed T3 or IIOP listeners.

Affected Products

Oracle WebLogic Server 12.2.1.4.0
Oracle WebLogic Server 14.1.1.0.0
Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0

Discovery Timeline

2026-08-18 - CVE-2026-60672 published to NVD
2026-08-20 - Last updated in NVD database
Oracle Critical Patch Update (August 2026) - Oracle publishes security alert with patch guidance

Technical Details for CVE-2026-60672

Vulnerability Analysis

The vulnerability resides in the Core component of Oracle WebLogic Server and is reachable through the T3 and Internet Inter-ORB Protocol (IIOP) remote invocation channels. These protocols expose Java remote method invocation services that WebLogic uses for administrative and clustering operations. The Exploit Prediction Scoring System (EPSS) score is 0.522%, placing this issue in the 42nd percentile for likelihood of near-term exploitation. Historical Oracle WebLogic advisories targeting T3 and IIOP have repeatedly attracted exploit tooling, so defenders should treat this issue as high priority.

Root Cause

The root cause is missing authentication on a critical function [CWE-306]. The affected code path processes remote requests over T3 and IIOP without adequately validating the caller's identity or authorization. Oracle has not published low-level technical details in the public advisory. See the Oracle Security Alert for the authoritative advisory.

Attack Vector

Exploitation requires only network reachability to a T3 or IIOP listener on the WebLogic Server. No credentials, prior access, or user interaction are required. The attacker sends a crafted request to the exposed protocol endpoint. Because WebLogic administration interfaces are frequently deployed on internal networks with broad reachability, the practical attack surface is often larger than intended.

No verified public proof-of-concept code has been released at the time of publication. Refer to the vendor advisory for authoritative technical guidance.

Detection Methods for CVE-2026-60672

Indicators of Compromise

Unexpected inbound TCP connections to WebLogic T3 listener ports (default 7001) or IIOP ports from untrusted networks.
New or modified .jsp, .war, or .class files under WebLogic deployment directories following inbound T3/IIOP traffic.
WebLogic server processes spawning child processes such as cmd.exe, powershell.exe, /bin/sh, or bash outside normal operational patterns.
Outbound network connections initiated by the WebLogic Java process to unfamiliar external hosts.

Detection Strategies

Inspect WebLogic access and audit logs for T3 and IIOP protocol handshakes originating from unexpected source addresses.
Baseline the parent-child process tree for java processes running WebLogic and alert on deviations.
Correlate network flow data with WebLogic listener ports to identify scanning and reconnaissance patterns.

Monitoring Recommendations

Forward WebLogic domain, server, and access logs to a centralized analytics pipeline for retention and correlation.
Monitor filesystem changes under $DOMAIN_HOME/servers/ for unexpected writes indicative of webshell deployment.
Track authentication and administrative actions in the WebLogic console for anomalies following any suspicious network events.

How to Mitigate CVE-2026-60672

Immediate Actions Required

Apply the Oracle Critical Patch Update referenced in the Oracle Security Alert to all affected WebLogic Server versions.
Inventory every WebLogic Server instance running 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0 and confirm patch status.
Restrict network access to T3 and IIOP listener ports to trusted management networks only.
Review recent access and audit logs for signs of exploitation before, during, and after patching.

Patch Information

Oracle addressed CVE-2026-60672 as part of its Critical Patch Update program. Administrators should download and apply the relevant patch for their specific WebLogic version from My Oracle Support. Consult the Oracle Security Alert for the official advisory and patch references.

Workarounds

Disable the T3 and IIOP protocols on internet-facing WebLogic instances if they are not required for business operations.
Configure a WebLogic connection filter (weblogic.security.net.ConnectionFilterImpl) to explicitly allow T3 and IIOP only from authorized management subnets.
Place WebLogic administrative interfaces behind a segmented network zone with strict firewall rules and jump-host access.

bash

# Example: restrict T3 and IIOP to a management subnet using a WebLogic connection filter
# Set in the WebLogic Admin Console: Domain > Security > Filter
# Connection Filter: weblogic.security.net.ConnectionFilterImpl
# Connection Filter Rules:
10.10.0.0/24 * * allow t3 t3s iiop iiops
0.0.0.0/0 * * deny t3 t3s iiop iiops