CVE-2026-60202 is an easily exploitable vulnerability in Oracle WebLogic Server's core component that permits unauthenticated attackers with network access via T3 and IIOP protocols to fully compromise the server. The vulnerability affects multiple supported versions of Oracle WebLogic Server (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0). The CVSS 3.1 base score is 9.8, indicating critical severity with high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory includes security patches addressing vulnerabilities across many products, including Oracle WebLogic Server. Customers are urged to apply patches without delay to mitigate this risk. No public exploit activity has been confirmed at this time.

Successful exploitation of this vulnerability allows an unauthenticated attacker with network access via T3 or IIOP to take over the Oracle WebLogic Server. This results in full compromise of confidentiality, integrity, and availability of the affected server, potentially leading to unauthorized data access, modification, and denial of service.

Oracle has released a Critical Patch Update in July 2026 that includes security patches addressing this vulnerability among others. Customers should promptly apply the patches provided in this update to affected Oracle WebLogic Server versions. Since the vendor advisory does not explicitly state otherwise, patch status should be confirmed by reviewing the July 2026 Critical Patch Update documentation at https://www.oracle.com/security-alerts/cpujul2026.html. There are no vendor statements indicating that no action is required or that the issue is already mitigated without patching.