CVE-2026-60208 is a vulnerability in the Core component of Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. It allows an unauthenticated attacker with network access via HTTP to compromise the server, resulting in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by the server. The vulnerability has a CVSS 3.1 base score of 9.1 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, indicating network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality and integrity impact. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not explicitly confirm patch availability or remediation level for this specific issue. Users are advised to review the advisory and apply relevant patches promptly to mitigate risk.

Successful exploitation of CVE-2026-60208 allows an unauthenticated remote attacker to gain unauthorized creation, deletion, or modification access to critical data or full access to all data accessible by Oracle WebLogic Server. This compromises confidentiality and integrity of the server's data, potentially leading to significant data breaches or manipulation. The vulnerability does not impact availability according to the CVSS vector. No known exploits in the wild have been reported at this time.

Oracle has released a Critical Patch Update advisory in July 2026 that addresses multiple security vulnerabilities including this one. Although patch availability for CVE-2026-60208 is not explicitly confirmed, Oracle strongly recommends that customers remain on actively supported versions and apply security patches without delay. Users should consult the Oracle Critical Patch Update July 2026 advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch information and installation instructions. Until patches are applied, restrict network access to Oracle WebLogic Server instances where possible.