CVE-2026-60291
Received Received - Intake

Unauthenticated Remote Code Execution in Oracle WebLogic Server

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: Oracle

Description
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-21
Last Modified
2026-07-21
Generated
2026-07-22
AI Q&A
2026-07-22
EPSS Evaluated
N/A
NVD
CVE-2026-60291

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
oracle weblogic_server 12.2.1.4.0
oracle weblogic_server 14.1.1.0.0
oracle weblogic_server 14.1.2.0.0
oracle weblogic_server 15.1.1.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a critical vulnerability in Oracle WebLogic Server that allows unauthenticated attackers to remotely compromise the server via HTTP. Successful exploitation can lead to full takeover of the affected system.

Detection Guidance

Detecting this vulnerability requires checking for vulnerable versions of Oracle WebLogic Server. Use commands like 'curl -v http://[target]:[port]/console' to check server headers for version info. Inspect logs for unusual HTTP requests targeting '/console' or '/weblogic' paths. Network scans with tools like Nmap can identify WebLogic instances by service fingerprints.

Impact Analysis

An attacker could gain complete control over your Oracle WebLogic Server, potentially accessing, modifying, or deleting sensitive data, installing malware, or using the server for further attacks.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or health data, violating GDPR or HIPAA requirements for data protection and confidentiality.

Mitigation Strategies

Immediately apply the latest Oracle WebLogic Server patches from Oracle's Critical Patch Update. If patching is not possible, restrict network access to the server via firewall rules to limit exposure. Disable unnecessary services like the admin console if not in use. Monitor for suspicious activity and consider isolating affected systems.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-60291. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart