CVE-2026-60201 is a vulnerability in the Core component of Oracle WebLogic Server that permits an unauthenticated attacker with network access via T3 and IIOP protocols to compromise the server. The vulnerability affects versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects a network attack vector with high attack complexity and no privileges or user interaction required, resulting in high confidentiality, integrity, and availability impacts. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among 1449 patches but does not explicitly confirm patch availability or remediation status for this specific issue in the provided content. Customers are strongly advised to remain on supported versions and apply Oracle patches without delay to mitigate this risk.

Successful exploitation of CVE-2026-60201 can lead to complete takeover of Oracle WebLogic Server, impacting confidentiality, integrity, and availability of the affected system. The vulnerability is exploitable remotely without authentication but requires network access via T3 or IIOP protocols and has high attack complexity. There are no known exploits in the wild at this time. The impact severity is high due to the potential for full system compromise.

Oracle has released a Critical Patch Update in July 2026 that addresses this vulnerability among many others. Although the provided advisory content does not explicitly confirm patch availability for CVE-2026-60201, Oracle strongly recommends applying all relevant security patches promptly on supported versions. Users should consult the official Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for detailed patch availability and installation instructions. No alternative mitigations or workarounds are stated in the advisory content.