CVE-2026-60293
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
Vulnerability in Oracle WebLogic Server (WLS - Web Services component) allows an unauthenticated attacker to remotely access critical data. The attack may impact other products.
Risk Assessment
Risk of application data leakage and potential impact on other systems.
Recommendation
Apply the Oracle patch for versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.
Other vulnerabilities in Oracle WebLogic Server
See all- CVE-2017-10147High
A vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware allows an unauthenticated attacker with network access via T3 to compromise the server. Attacks may lead to hanging or frequent crashes of the server, resulting in a complete denial of service (DoS).
- CVE-2016-3505High
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12.2.1.0 allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to JavaServer Faces.
- CVE-2016-0577High
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and availability.
- CVE-2016-0574High
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and availability.
- CVE-2016-0573High
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS Java Messaging Service.
- CVE-2016-0572High
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Coherence Container.
- CVE-2014-2470High
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2.0, 10.3.6.0, 12.1.1.0, and 12.1.2.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS Security.
- CVE-2026-60977Critical
Vulnerability in Oracle WebLogic Server (component: WLS Core Components) affects versions 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable flaw allows unauthenticated attacker with network access via RMI to compromise Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).
- CVE-2026-60702Critical
Vulnerability in Oracle WebLogic Server (component: Core) allows a low-privileged attacker via T3 or IIOP to completely take over the server. The attack may impact other products (scope change). CVSS score 9.9.
- CVE-2026-60698Critical
Vulnerability in Oracle WebLogic Server (component: Core) allows an unauthenticated attacker via IIOP to completely take over the server. CVSS score 9.8.
Original NVD description (English source)
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS - Web Services). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. While the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).