CVE-2026-60699: Oracle WebLogic Auth Bypass Vulnerability

CVE-2026-60699 Overview

CVE-2026-60699 is a high-severity vulnerability in the Core component of Oracle WebLogic Server, part of Oracle Fusion Middleware. An unauthenticated remote attacker with network access to the T3 or Internet Inter-ORB Protocol (IIOP) listeners can compromise the server without user interaction. The flaw carries a scope-changed impact, meaning successful exploitation can affect resources beyond the WebLogic Server itself. The vulnerability is categorized under [CWE-284] Improper Access Control and results in unauthorized access to critical data accessible through WebLogic.

Critical Impact
Unauthenticated network attackers can access all data reachable through affected Oracle WebLogic Server instances, with scope change extending impact to additional Oracle Fusion Middleware products.

Affected Products

Oracle WebLogic Server 12.2.1.4.0
Oracle WebLogic Server 14.1.1.0.0 and 14.1.2.0.0
Oracle WebLogic Server 15.1.1.0.0

Discovery Timeline

2026-08-18 - CVE-2026-60699 published to the National Vulnerability Database (NVD)
2026-08-20 - Last updated in NVD database
2026-08-20 - EPSS score recorded at 0.394%

Technical Details for CVE-2026-60699

Vulnerability Analysis

The vulnerability resides in the Core component of Oracle WebLogic Server and is exposed through the T3 and IIOP remote invocation protocols. These protocols support remote method invocation (RMI) between WebLogic clients and servers. The issue is classified as Improper Access Control [CWE-284], allowing unauthenticated attackers to reach protected functionality or data.

Oracle notes the scope changes upon exploitation, meaning the vulnerable component can influence resources beyond its own security authority. Successful attacks yield unauthorized read access to any data the WebLogic Server can reach, including credentials, configuration, and application data.

The attack requires no privileges, no user interaction, and low complexity. Confidentiality impact is high; integrity and availability are not affected by this specific issue.

Root Cause

The root cause is improper access control in how the WebLogic Core component authorizes requests received over T3 and IIOP. Historical WebLogic advisories in this class typically involve inadequate validation of remote invocation payloads or trust decisions made before authentication is enforced. Oracle has not published low-level technical details for this CVE.

Attack Vector

Exploitation is remote and network-based. An attacker sends crafted T3 or IIOP traffic to a reachable WebLogic listener, which by default runs on the same port as HTTP. See the Oracle Security Alert for vendor guidance. No verified proof-of-concept code is publicly available at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Detection Methods for CVE-2026-60699

Indicators of Compromise

Unexpected inbound connections to WebLogic T3 or T3s listener ports (default 7001/7002) from untrusted networks.
IIOP handshake traffic originating from external or non-application sources.
WebLogic access logs showing anomalous remote method invocations or serialized object payloads.
Server-side outbound connections following inbound T3/IIOP activity, indicating scope-changing follow-on actions.

Detection Strategies

Monitor WebLogic AccessLog and server.log for repeated T3/IIOP session initiations from a single source.
Deploy network detection signatures for T3 protocol magic bytes and IIOP GIOP headers reaching non-application clients.
Baseline legitimate WebLogic RMI client sources and alert on deviations.

Monitoring Recommendations

Enable verbose logging on WebLogic protocol handlers and forward logs to a centralized SIEM.
Track process behavior on WebLogic hosts for unexpected child processes or file reads following remote invocation activity.
Alert on outbound data transfers from WebLogic hosts that exceed normal application baselines.

How to Mitigate CVE-2026-60699

Immediate Actions Required

Apply the Oracle Critical Patch Update referenced in the Oracle Security Alert for WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
Restrict network exposure of T3 and IIOP listeners to trusted management networks only.
Inventory all WebLogic Server instances, including embedded deployments in other Oracle Fusion Middleware products.

Patch Information

Oracle addressed this vulnerability in its August 2026 Security Alert cycle. Administrators should consult the Oracle Security Alert for the specific patch identifiers matching their WebLogic version and apply them per Oracle's patch application guidance.

Workarounds

Use the WebLogic Connection Filter (weblogic.security.net.ConnectionFilterImpl) to deny T3 and IIOP traffic from untrusted sources.
Disable the IIOP protocol on Managed Servers where it is not required through the Administration Console under Protocols configuration.
Place WebLogic servers behind a reverse proxy that terminates only HTTP/HTTPS traffic and blocks T3/IIOP at the network boundary.

bash

# Example WebLogic connection filter rules (config.xml or Admin Console)
# Deny T3 and IIOP from any host except the internal management subnet
10.0.0.0/8 * * allow t3 t3s iiop iiops
0.0.0.0/0 * * deny  t3 t3s iiop iiops