CVE-2026-60198

CriticalCVSS 9.8

Published: 21/07/2026(UTC)Updated: 28/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.50%

40th percentile - higher than 40% of all known CVEs

Summary

In Oracle WebLogic Server (component: Core), a vulnerability can be exploited by an unauthenticated attacker over the network via T3 and IIOP protocols. Successful attack can lead to complete server takeover.

Risk Assessment

An attacker can fully compromise the WebLogic server, resulting in loss of confidentiality, integrity, and availability.

Recommendation

Apply the security patch provided by Oracle for the affected versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) immediately.

Original NVD description (English source)

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).