CVE-2026-60291 is a vulnerability in the Core component of Oracle WebLogic Server that allows an unauthenticated attacker with network access via HTTP to compromise the server completely. The vulnerability affects versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The CVSS 3.1 score is 9.8, reflecting critical severity with impacts on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory includes security patches for multiple products, including Oracle WebLogic Server, and recommends applying patches without delay. However, the vendor advisory does not explicitly confirm the patch status for this CVE in the provided content. No known exploits in the wild have been reported at this time.

Successful exploitation of this vulnerability can lead to complete takeover of Oracle WebLogic Server, impacting confidentiality, integrity, and availability of the affected system. This allows an unauthenticated attacker to execute arbitrary code or commands remotely, potentially leading to full system compromise.

Oracle has released a Critical Patch Update advisory in July 2026 that addresses this vulnerability among many others. Users should review the advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply the relevant patches promptly. Patch status for this specific vulnerability is not explicitly confirmed in the advisory content provided; therefore, users must verify patch availability and installation instructions from Oracle's official resources. No alternative mitigations or workarounds are stated in the advisory.