CVE-2026-60679: Oracle WebLogic Server Auth Bypass Flaw

CVE-2026-60679 Overview

CVE-2026-60679 is an authentication weakness [CWE-287] in the Core component of Oracle WebLogic Server, part of Oracle Fusion Middleware. The flaw affects supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. A low-privileged attacker with network access via the T3 or IIOP protocols can compromise the server, resulting in full takeover. Oracle rates the issue as difficult to exploit but assigns high impact to confidentiality, integrity, and availability. The vulnerability was published to the National Vulnerability Database (NVD) on August 18, 2026.

Critical Impact
Successful exploitation grants an attacker full takeover of Oracle WebLogic Server through the T3 or IIOP remoting protocols.

Affected Products

Oracle WebLogic Server 12.2.1.4.0
Oracle WebLogic Server 14.1.1.0.0 and 14.1.2.0.0
Oracle WebLogic Server 15.1.1.0.0

Discovery Timeline

2026-08-18 - CVE-2026-60679 published to NVD
2026-08-20 - Last updated in NVD database
2026-08-18 - Oracle publishes security alert addressing the vulnerability

Technical Details for CVE-2026-60679

Vulnerability Analysis

The flaw resides in the Core component of Oracle WebLogic Server and maps to Improper Authentication [CWE-287]. An attacker who already holds a low-privileged account on the target can leverage exposed remoting endpoints to escalate to full server compromise. Oracle's advisory notes that the attack complexity is high, meaning the adversary must satisfy specific runtime conditions to succeed. However, once exploited, the impact covers confidentiality, integrity, and availability. Historically, WebLogic remoting protocols have been abused for deserialization and authentication bypass chains that lead to remote code execution. The reference for this issue is documented in the Oracle Security Alert.

Root Cause

The root cause is improper authentication handling in the WebLogic Core component when processing requests over the T3 (Oracle's proprietary Remote Method Invocation protocol) and IIOP (Internet Inter-ORB Protocol) channels. These channels historically expose internal Java object handling to remote callers. Oracle has not disclosed the exact code path, but the CWE-287 classification indicates that identity verification is not enforced correctly for certain remoting operations.

Attack Vector

Exploitation requires network reachability to the WebLogic listen address and a valid low-privileged credential. The attacker sends crafted T3 or IIOP traffic to invoke sensitive operations without the expected authentication context. Because T3 and IIOP are typically enabled by default on the administrative and managed server ports, environments that expose those ports outside trusted networks face elevated risk. The Exploit Prediction Scoring System (EPSS) currently places the probability of exploitation at 0.301% as of 2026-08-20, though this can rise after public technical details emerge.

No verified proof-of-concept code is publicly available. See the Oracle Security Alert for vendor guidance.

Detection Methods for CVE-2026-60679

Indicators of Compromise

Unexpected inbound connections to WebLogic T3 ports (default 7001) or IIOP listener ports from untrusted sources.
Anomalous authentication events on low-privileged WebLogic accounts followed by administrative actions.
New or modified deployments, MBean changes, or startup classes not aligned with change management records.
Outbound network calls from the WebLogic JVM to unfamiliar hosts, indicating post-exploitation staging.

Detection Strategies

Enable WebLogic auditing at the Success/Failure level and forward logs to a centralized platform for correlation.
Inspect T3 and IIOP traffic with network sensors capable of decoding Java serialized objects for known gadget classes.
Correlate low-privileged account authentications with subsequent MBean or JMX operations that require higher privileges.

Monitoring Recommendations

Alert on any external exposure of WebLogic 7001/7002 ports and IIOP listeners.
Track WebLogic patch level (registry.xml) and compare against the August 2026 Critical Patch Update baseline.
Monitor JVM process behavior for unexpected child processes, script interpreters, or file writes outside deployment directories.

How to Mitigate CVE-2026-60679

Immediate Actions Required

Apply the Oracle Critical Patch Update referenced in the August 2026 security alert to all affected WebLogic versions.
Inventory every WebLogic instance and confirm the patch level after remediation.
Restrict network reachability to T3 and IIOP ports to trusted management segments only.
Rotate credentials for any low-privileged WebLogic accounts that could be leveraged as the exploitation prerequisite.

Patch Information

Oracle addresses this vulnerability in the Oracle Security Alert published for August 2026. Administrators must apply the fix bundle appropriate to versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0. Oracle recommends applying Critical Patch Updates promptly, as fixes are cumulative.

Workarounds

Use the WebLogic Connection Filter (weblogic.security.net.ConnectionFilterImpl) to block T3 and IIOP from untrusted networks until patches are applied.
Disable the IIOP protocol on managed servers that do not require CORBA interoperability.
Place WebLogic administrative interfaces behind a VPN or bastion host, and prevent direct internet exposure.
Enforce least-privilege on WebLogic security realms so that low-privileged accounts cannot reach sensitive MBeans.

bash

# Example: restrict T3/IIOP to a trusted subnet using WebLogic Connection Filter rules
# Configure in the Admin Console: Security > Filter > Connection Filter Rules
10.0.0.0/8 * allow t3 t3s iiop iiops
0.0.0.0/0  * deny  t3 t3s iiop iiops