CVE-2026-60202

CriticalCVSS 9.8

Published: 21/07/2026(UTC)Updated: 29/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.51%

41th percentile - higher than 41% of all known CVEs

Summary

Critical vulnerability in Oracle WebLogic Server (Core component) allows an unauthenticated attacker to remotely take over the server via network using T3 and IIOP protocols. The attack does not impact other products (no scope change).

Risk Assessment

Risk of full takeover of the Oracle WebLogic Server, leading to compromise of confidentiality, integrity, and availability.

Recommendation

Immediately apply the patch provided by Oracle for versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Disable or restrict T3 and IIOP protocol access to trusted networks only.

Original NVD description (English source)

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).