CVE-2026-60977 Overview
CVE-2026-60977 is a critical vulnerability in Oracle WebLogic Server, part of Oracle Fusion Middleware. The flaw resides in the WLS Core Components and is exploitable by an unauthenticated attacker with network access through Remote Method Invocation (RMI). Successful exploitation results in complete takeover of the WebLogic Server, impacting confidentiality, integrity, and availability.
Oracle published the vulnerability in its August 2026 Critical Patch Update Security Alert. Affected supported versions include 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0. Because WebLogic Server frequently hosts business-critical Java EE applications, this vulnerability presents immediate risk to enterprise middleware deployments.
Critical Impact
Unauthenticated remote attackers can compromise Oracle WebLogic Server via RMI, leading to full server takeover with confidentiality, integrity, and availability impact.
Affected Products
- Oracle WebLogic Server 12.2.1.4.0
- Oracle WebLogic Server 14.1.1.0.0
- Oracle WebLogic Server 14.1.2.0.0
Discovery Timeline
- 2026-08-18 - CVE-2026-60977 published to the National Vulnerability Database (NVD)
- 2026-08-20 - Last updated in NVD database
- August 2026 - Oracle publishes the Oracle Security Alert with patch guidance
Technical Details for CVE-2026-60977
Vulnerability Analysis
The vulnerability affects the WLS Core Components of Oracle WebLogic Server. An unauthenticated attacker with network access to the RMI listener can send crafted requests that lead to full server compromise. Oracle classifies the issue as easily exploitable, requiring no privileges or user interaction.
Historically, WebLogic RMI vulnerabilities have involved unsafe handling of serialized Java objects. Attackers typically abuse deserialization gadgets in classpath libraries to achieve remote code execution during object unmarshalling. While Oracle's advisory does not enumerate the internal defect, the attack profile and CVSS vector are consistent with prior RMI-facing deserialization flaws in the T3 and IIOP protocol stacks.
The EPSS score of 0.522% (percentile 42.167) reflects current exploit prediction data, but WebLogic RMI issues have historically been weaponized quickly after disclosure.
Root Cause
The CWE is listed as NVD-CWE-noinfo, and Oracle does not publish technical root-cause details. Based on the exposed protocol (RMI) and impact profile, the defect is a server-side flaw in how WebLogic processes untrusted remote invocations against WLS Core Components.
Attack Vector
The attack vector is network-based. An attacker sends malicious RMI traffic to a reachable WebLogic Server listener. No authentication, privileges, or user interaction are required. Successful exploitation permits arbitrary actions within the WebLogic process, effectively yielding full server takeover.
Organizations exposing WebLogic RMI (default T3/T3s on 7001/7002, or IIOP) to untrusted networks are at highest risk. Internally reachable instances can also be pivoted against by attackers already inside the perimeter.
No verified public proof-of-concept exploit is currently available. Refer to the Oracle Security Alert for authoritative technical details.
Detection Methods for CVE-2026-60977
Indicators of Compromise
- Unexpected inbound TCP connections to WebLogic RMI ports such as 7001 (T3) and 7002 (T3s) from untrusted sources.
- WebLogic java processes spawning child processes such as cmd.exe, powershell.exe, /bin/sh, or bash.
- New or modified files in WebLogic domain directories, particularly under servers/*/tmp/, stage/, or deployment folders.
- Outbound connections from the WebLogic host to attacker-controlled infrastructure following inbound RMI traffic.
Detection Strategies
- Monitor WebLogic access logs and AdminServer.log for anomalous T3, T3s, or IIOP requests, including malformed serialized payloads.
- Alert on process-lineage anomalies where the WebLogic JVM launches shell interpreters or scripting utilities.
- Correlate authentication-free RMI traffic with subsequent file writes or scheduled task creation on the host.
Monitoring Recommendations
- Enable and centralize WebLogic domain and server logs into your SIEM or data lake for retention and correlation.
- Track network flow data to WebLogic listeners and baseline expected clients so unusual RMI sources trigger alerts.
- Review WebLogic patch levels continuously and reconcile deployed versions against Oracle's August 2026 CPU list.
How to Mitigate CVE-2026-60977
Immediate Actions Required
- Apply the August 2026 Oracle Critical Patch Update to all affected WebLogic Server instances (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0) as soon as possible.
- Restrict network access to WebLogic RMI ports (7001, 7002, IIOP) so only trusted management hosts can reach them.
- Inventory all WebLogic deployments, including embedded and legacy instances, to ensure none are missed during patching.
- Review WebLogic hosts for signs of prior compromise before returning them to production trust.
Patch Information
Oracle addressed CVE-2026-60977 in the August 2026 Critical Patch Update Security Alert. Administrators should download and apply the fixes referenced in the Oracle Security Alert for their specific WebLogic version. Patching is the only fully supported remediation.
Workarounds
- Use network access control lists or firewalls to block untrusted access to T3, T3s, and IIOP ports until patches are applied.
- Disable IIOP in the WebLogic Administration Console if it is not required by applications.
- Apply WebLogic connection filters (weblogic.security.net.ConnectionFilterImpl) to allowlist RMI clients by source address and protocol.
- Place vulnerable WebLogic instances behind a reverse proxy that terminates only required HTTP traffic and blocks direct RMI exposure.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
