CVE-2026-60204 is a vulnerability in the Core component of Oracle WebLogic Server that allows an unauthenticated attacker with network access via T3 and IIOP protocols to compromise the server. The vulnerability affects Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. It has a CVSS 3.1 base score of 9.8, reflecting critical severity with impacts on confidentiality, integrity, and availability. The vulnerability is easily exploitable and can lead to full server takeover. Oracle's July 2026 Critical Patch Update advisory references multiple patches for various products but does not explicitly confirm patch availability or remediation status for this specific CVE. Users are urged to consult the advisory and apply relevant patches as soon as they become available.

This vulnerability allows an unauthenticated attacker with network access via T3 or IIOP protocols to fully compromise Oracle WebLogic Server, potentially resulting in complete takeover of the server. The CVSS score of 9.8 indicates critical impact affecting confidentiality, integrity, and availability of the affected system.

Oracle has released a Critical Patch Update advisory in July 2026 addressing numerous vulnerabilities, including those in Oracle WebLogic Server. Although explicit patch availability for CVE-2026-60204 is not confirmed in the advisory content provided, Oracle strongly recommends applying all relevant security patches promptly and remaining on actively supported versions. Users should monitor the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for updated patch information and apply patches as soon as they are available to mitigate this vulnerability.