This vulnerability in Oracle WebLogic Server's core component allows an unauthenticated attacker to remotely exploit the server via HTTP without any privileges or user interaction. Successful exploitation can lead to complete takeover of the Oracle WebLogic Server, impacting confidentiality, integrity, and availability. The vulnerability affects specific versions: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle's July 2026 Critical Patch Update advisory references a large set of security patches across many products, including Oracle WebLogic Server, and urges customers to apply patches without delay. The advisory does not explicitly confirm the availability of a patch for this specific CVE, so patch status remains unconfirmed pending vendor confirmation.

An unauthenticated attacker with network access via HTTP can exploit this vulnerability to fully compromise Oracle WebLogic Server instances running affected versions. This results in complete loss of confidentiality, integrity, and availability of the server, effectively allowing an attacker to take over the server and potentially execute arbitrary code or disrupt services.

Oracle has released a Critical Patch Update advisory in July 2026 that addresses multiple vulnerabilities including those in Oracle WebLogic Server. Customers are strongly advised to remain on actively supported versions and apply the security patches from this update without delay. Patch status for CVE-2026-60199 is not explicitly confirmed in the advisory content provided; therefore, users should consult the official Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Until patches are applied, restrict network access to Oracle WebLogic Server instances where possible.