CVE-2026-60698: Oracle WebLogic Server RCE Vulnerability

CVE-2026-60698 Overview

CVE-2026-60698 is a critical vulnerability in the Core component of Oracle WebLogic Server, part of Oracle Fusion Middleware. The flaw allows an unauthenticated attacker with network access via the Internet Inter-ORB Protocol (IIOP) to fully compromise the server. Successful exploitation results in complete takeover of confidentiality, integrity, and availability. The vulnerability is categorized under CWE-306: Missing Authentication for Critical Function. Affected supported versions include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.

Critical Impact
Unauthenticated remote attackers can take over Oracle WebLogic Server instances over the network via IIOP, leading to full compromise of hosted applications and data.

Affected Products

Oracle WebLogic Server 12.2.1.4.0
Oracle WebLogic Server 14.1.1.0.0
Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0

Discovery Timeline

2026-08-18 - CVE-2026-60698 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-60698

Vulnerability Analysis

The vulnerability resides in the Core component of Oracle WebLogic Server and is reachable through the IIOP listener. Because the vulnerable code path does not enforce authentication before processing attacker-supplied data, a remote attacker can interact with server-side objects without credentials. Oracle's advisory describes the flaw as easily exploitable, requiring only network reachability to the IIOP port. Successful exploitation yields full server takeover, giving the attacker control over deployed applications, configuration, and data.

Root Cause

The root cause is a missing authentication check on a critical server function exposed through the IIOP interface [CWE-306]. IIOP is the Common Object Request Broker Architecture (CORBA) transport used by WebLogic for remote Enterprise JavaBeans and T3 interoperability. When authentication is not enforced on this path, attackers can invoke privileged operations directly. Historically, WebLogic IIOP and T3 handlers have processed serialized Java objects, which frequently converts missing authentication into unauthenticated remote code execution.

Attack Vector

An attacker sends crafted IIOP traffic to an exposed WebLogic listener over the network. No credentials, user interaction, or prior foothold are required. Because IIOP is often enabled by default on the same port as T3, any WebLogic instance reachable from an attacker-controlled network is a candidate for exploitation. Refer to the Oracle Security Alert for authoritative technical details. No public proof-of-concept code is available at the time of publication.

Detection Methods for CVE-2026-60698

Indicators of Compromise

Unexpected inbound connections to WebLogic IIOP/T3 ports (default 7001, 7002) from untrusted networks.
New or modified deployments, WAR files, or scheduled tasks under the WebLogic domain directory without a change-management record.
Child processes such as cmd.exe, powershell.exe, bash, or sh spawned by the WebLogic Java process.
Outbound connections from the WebLogic host to unknown external hosts shortly after inbound IIOP traffic.

Detection Strategies

Inspect WebLogic access and server logs for anomalous IIOP requests, deserialization errors, or stack traces referencing weblogic.iiop or weblogic.rjvm.
Alert on process-lineage anomalies where the Java process running WebLogic launches shells or scripting interpreters.
Correlate network telemetry for IIOP port exposure against expected internal-only communication baselines.

Monitoring Recommendations

Enable verbose logging on the WebLogic IIOP subsystem and forward logs to a centralized analytics platform.
Continuously monitor egress traffic from application server subnets for reverse shells or unexpected downloads.
Track file integrity within $DOMAIN_HOME/servers/*/tmp and $DOMAIN_HOME/servers/*/upload for unauthorized artifact drops.

How to Mitigate CVE-2026-60698

Immediate Actions Required

Apply the Oracle Critical Patch Update referenced in the Oracle Security Alert to all affected WebLogic instances.
Block IIOP and T3 access from untrusted networks at the perimeter and internal firewalls until patches are deployed.
Inventory all Oracle WebLogic Server deployments to confirm versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 are identified and prioritized.

Patch Information

Oracle addressed this vulnerability in the August 2026 Critical Patch Update. Administrators should download and apply the corresponding patch bundle for each affected WebLogic version from My Oracle Support. See the Oracle Security Alert for the definitive patch matrix and installation guidance.

Workarounds

Disable the IIOP protocol on WebLogic managed servers if it is not required by applications.
Restrict IIOP and T3 listeners to trusted management networks using network ACLs and the WebLogic Connection Filter (weblogic.security.net.ConnectionFilterImpl).
Place WebLogic behind a reverse proxy that terminates only HTTP/HTTPS and prevents direct exposure of RMI/IIOP ports.

bash

# Example WebLogic Connection Filter rule to deny IIOP from untrusted sources
# Set in WebLogic Admin Console: Security > Filter
# Format: target localAddress localPort action protocols
* * 7001 deny iiop iiops t3 t3s
10.0.0.0/8 * 7001 allow iiop t3