CVE-2026-60203 is a vulnerability in the Core component of Oracle WebLogic Server that permits a low privileged attacker with network access via HTTP to compromise the server. Affected versions include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high impact on confidentiality, integrity, and availability. The vulnerability is classified under CWE-306 (Missing Authentication for Critical Function). Oracle's July 2026 Critical Patch Update advisory references multiple security patches but does not explicitly state the patch status for this CVE. No known public exploits have been reported to date.

Successful exploitation of this vulnerability allows an attacker with low privileges and network access via HTTP to fully compromise Oracle WebLogic Server, impacting confidentiality, integrity, and availability. This could lead to complete server takeover.

Oracle has released a Critical Patch Update in July 2026 that addresses numerous vulnerabilities across its product portfolio. However, the vendor advisory does not explicitly confirm whether a patch for CVE-2026-60203 is included or available. Users should consult the official Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and apply relevant patches promptly. Until patch confirmation, monitor Oracle advisories for updates. No vendor statement indicates that no action is required or that the vulnerability is already mitigated.