CVE-2026-60702: Oracle WebLogic Server Auth Bypass Flaw

CVE-2026-60702 Overview

CVE-2026-60702 is a critical vulnerability in the Core component of Oracle WebLogic Server, part of Oracle Fusion Middleware. The flaw allows a low-privileged attacker with network access via the T3 or IIOP protocols to compromise the server. Successful exploitation results in full takeover of the WebLogic Server instance. The vulnerability introduces a scope change, meaning attacks can significantly impact additional products beyond WebLogic itself. Oracle published this issue in its August 2026 Critical Patch Update alert. The weakness is classified under [CWE-284] Improper Access Control.

Critical Impact
A low-privileged remote attacker can achieve complete takeover of Oracle WebLogic Server through T3 or IIOP protocol access, with impacts extending to connected systems due to scope change.

Affected Products

Oracle WebLogic Server 12.2.1.4.0
Oracle WebLogic Server 14.1.1.0.0 and 14.1.2.0.0
Oracle WebLogic Server 15.1.1.0.0

Discovery Timeline

2026-08-18 - CVE-2026-60702 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-60702

Vulnerability Analysis

The vulnerability resides in the Core component of Oracle WebLogic Server and is exposed through the T3 and Internet Inter-ORB Protocol (IIOP) remote invocation protocols. Both protocols are commonly used for remote management, clustering, and Java client interactions with WebLogic. An attacker with a low-privileged account can reach these protocol endpoints over the network to compromise the server.

Because the vulnerability causes a scope change, an exploit against WebLogic can affect resources managed by other trust boundaries. Successful exploitation results in complete loss of confidentiality, integrity, and availability, aligning with the classic pattern of WebLogic T3/IIOP takeover vulnerabilities.

Root Cause

Oracle categorizes the underlying weakness as improper access control [CWE-284] in the Core component. The T3 and IIOP protocol handlers do not sufficiently restrict operations available to authenticated but low-privileged principals. This gap permits privileged operations to be reached from a low-trust context, leading to server takeover.

Attack Vector

The attack path requires network access to WebLogic's T3 or IIOP listeners and valid credentials at a low privilege tier. Attackers frequently target Internet-exposed WebLogic instances where administrative protocols remain reachable. Refer to the Oracle Security Alert for authoritative technical details.

// No verified public exploit code is available.
// The vulnerability is reachable via authenticated T3/IIOP requests
// against WebLogic's Core component and results in server takeover.

Detection Methods for CVE-2026-60702

Indicators of Compromise

Unexpected inbound connections to WebLogic T3 listener ports (default 7001) or IIOP endpoints from untrusted network segments.
New or unexpected Java processes, shell processes, or files written under WebLogic domain directories.
Anomalous authentication attempts using low-privileged WebLogic accounts followed by administrative activity.

Detection Strategies

Inspect WebLogic access and audit logs for T3 or IIOP requests originating from unusual source addresses or accounts.
Correlate authentication events for low-privileged WebLogic users with subsequent process creation on the host.
Alert on outbound network connections initiated by the WebLogic JVM to unfamiliar destinations, which often indicate post-exploitation activity.

Monitoring Recommendations

Enable verbose WebLogic auditing and forward logs to a centralized SIEM for retention and correlation.
Monitor host-level telemetry on WebLogic servers for child processes spawned by the Java runtime.
Baseline normal T3/IIOP traffic patterns and alert on deviations, particularly bursts of serialized object traffic.

How to Mitigate CVE-2026-60702

Immediate Actions Required

Apply the fixes from the Oracle August 2026 Critical Patch Update alert to all affected WebLogic Server versions.
Inventory all WebLogic instances, including embedded deployments, and confirm patch status for versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
Restrict network exposure of T3 and IIOP listeners to trusted management networks only.
Rotate credentials for all WebLogic accounts, especially low-privileged service accounts reachable over the network.

Patch Information

Oracle released fixes as part of the August 2026 Critical Patch Update. Administrators should review the Oracle Security Alert and apply the patches corresponding to their deployed WebLogic version.

Workarounds

Use the WebLogic Server connection filter (weblogic.security.net.ConnectionFilterImpl) to block T3 and IIOP traffic from untrusted sources until patches are applied.
Disable IIOP in the WebLogic Administration Console if the protocol is not required by applications.
Place WebLogic administrative interfaces behind a VPN or bastion, and deny direct Internet access to protocol ports.

bash

# Example: restrict T3/T3s/IIOP to an internal management subnet
# Configure in WebLogic Console -> Server -> Protocols -> Connection Filter
#
# Filter class: weblogic.security.net.ConnectionFilterImpl
# Filter rules:
10.0.0.0/8   * *      allow  t3 t3s iiop iiops
0.0.0.0/0    * *      deny   t3 t3s iiop iiops