This vulnerability affects Oracle WebLogic Server, specifically versions 12.2.1.4.0 and 14.1.2.0.0, and is classified under CWE-306 (Missing Authentication for Critical Function). It allows an attacker with low privileges and network access via HTTP to compromise the server, potentially resulting in complete takeover. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impacts on confidentiality, integrity, and availability. The vendor advisory is a general Critical Patch Update advisory listing many patched products but does not explicitly state a patch or fix for this vulnerability. Patch status is therefore not yet confirmed and should be verified with Oracle's advisory.

Successful exploitation can lead to full compromise of Oracle WebLogic Server, affecting confidentiality, integrity, and availability of the affected system. This could allow attackers to execute arbitrary code, access sensitive data, and disrupt services.

Oracle's Critical Patch Update advisory for July 2026 references multiple vulnerabilities and patches but does not explicitly confirm a patch for CVE-2026-60207. Customers are strongly advised to monitor Oracle's official security alerts and apply patches promptly once available. Until a patch is confirmed, restrict network access to Oracle WebLogic Server instances and apply any recommended workarounds from Oracle. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.