CVE-2026-60696: Oracle WebLogic Server RCE Vulnerability

CVE-2026-60696 Overview

CVE-2026-60696 is a critical vulnerability in the Core component of Oracle WebLogic Server, part of Oracle Fusion Middleware. The flaw allows an unauthenticated attacker with network access via the T3 or Internet Inter-ORB Protocol (IIOP) to fully compromise the server. Affected versions include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The weakness is categorized under [CWE-306: Missing Authentication for Critical Function]. Oracle disclosed the vulnerability in its August 2026 Critical Patch Update.

Critical Impact
Successful exploitation results in complete takeover of the Oracle WebLogic Server with impact to confidentiality, integrity, and availability.

Affected Products

Oracle WebLogic Server 12.2.1.4.0
Oracle WebLogic Server 14.1.1.0.0
Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0

Discovery Timeline

2026-08-18 - CVE-2026-60696 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-60696

Vulnerability Analysis

The vulnerability resides in the Core component of Oracle WebLogic Server and is reachable over the T3 and IIOP remoting protocols. These protocols expose Java remote invocation surfaces used by WebLogic clients to communicate with server-side objects. An unauthenticated attacker with network reachability to a listening WebLogic port can trigger the vulnerable code path without user interaction. Oracle classifies exploitation as easy and describes the outcome as full server takeover.

Historically, T3 and IIOP have been recurring attack surfaces in WebLogic due to their handling of serialized Java objects and their exposure of privileged internal operations. Missing authentication ([CWE-306]) on a critical function means the attacker does not need valid credentials or a user session to trigger the vulnerable operation.

Root Cause

The root cause is the absence of an authentication check on a critical function reachable through the T3 and IIOP listeners. Any client that can establish a T3 or IIOP session to the WebLogic port can invoke the affected operation and obtain code execution or administrative control on the server.

Attack Vector

The attack vector is network-based. An attacker sends crafted T3 or IIOP traffic to an exposed WebLogic listen port, typically 7001/tcp or the IIOP port configured on the domain. No credentials, user interaction, or prior foothold are required. Refer to the Oracle Security Alert for the vendor's technical description. No public proof-of-concept has been observed at the time of publication.

Detection Methods for CVE-2026-60696

Indicators of Compromise

Unexpected inbound connections to WebLogic T3 listener ports (default 7001) or configured IIOP ports from untrusted sources.
Creation of new administrative accounts, unexpected deployed applications, or new JMS/JNDI bindings in WebLogic configuration.
Child processes spawned by the WebLogic JVM (java) such as cmd.exe, powershell.exe, /bin/sh, or bash.
Outbound network connections from the WebLogic host to unknown external IPs shortly after inbound T3/IIOP traffic.

Detection Strategies

Monitor WebLogic access and server logs for anomalous T3 and IIOP session activity, especially deserialization errors or class-resolution warnings.
Alert on WebLogic Java processes spawning shell interpreters or writing to web-accessible directories.
Correlate network flow data for external clients initiating T3/IIOP sessions where those protocols should be restricted to internal management traffic.

Monitoring Recommendations

Ingest WebLogic server logs, domain logs, and host process telemetry into a central analytics platform for correlation.
Baseline normal T3/IIOP traffic patterns and alert on deviations, including new source IPs or off-hours activity.
Track deployment and configuration changes to WebLogic domains via file integrity monitoring on the domain home directory.

How to Mitigate CVE-2026-60696

Immediate Actions Required

Apply the fixes from the Oracle August 2026 Critical Patch Update to all affected WebLogic versions without delay.
Inventory all internet-exposed WebLogic instances and remove direct exposure of T3 and IIOP to untrusted networks.
Rotate WebLogic administrative credentials and audit deployed applications after patching.

Patch Information

Oracle addresses CVE-2026-60696 in the August 2026 Critical Patch Update. Patches are available for supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Consult the Oracle Security Alert for the exact patch identifiers and download instructions applicable to each release.

Workarounds

Restrict T3 and IIOP access using WebLogic's Connection Filter (weblogic.security.net.ConnectionFilterImpl) to permit only trusted management hosts.
Place WebLogic behind a network firewall that blocks external access to T3, T3s, IIOP, and IIOPS listener ports.
Disable IIOP in the WebLogic administration console when the protocol is not required by applications.

bash

# Example WebLogic Connection Filter rules restricting T3/IIOP
# Configure in Admin Console: Domain > Security > Filter
# Format: target localAddress localPort action protocols

10.0.0.0/8    * 7001 allow t3 t3s iiop iiops
0.0.0.0/0     * 7001 deny  t3 t3s iiop iiops