CVE-2026-60293 is a vulnerability in Oracle WebLogic Server's Web Services component that permits an unauthenticated attacker with network access via HTTP to compromise the server. Affected versions include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Successful exploitation can lead to unauthorized access to critical or all data accessible by the server. The vulnerability has a CVSS 3.1 base score of 8.6, reflecting high confidentiality impact with no required privileges or user interaction. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others and advises customers to apply patches without delay. However, the advisory does not explicitly confirm patch availability or remediation level for this specific CVE, so users must verify patch status directly from Oracle's advisory.

The vulnerability allows unauthenticated remote attackers to gain unauthorized access to critical or all data accessible by Oracle WebLogic Server, potentially compromising confidentiality. There is no impact on integrity or availability reported. The scope of impact extends beyond WebLogic Server to additional Oracle products that rely on it. The CVSS score of 8.6 indicates a high-severity confidentiality breach risk without requiring privileges or user interaction.

Oracle has released a Critical Patch Update in July 2026 that addresses this and many other vulnerabilities. Customers are strongly advised to review the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply the relevant patches promptly. Patch status for this specific vulnerability is not explicitly stated, so users must verify patch availability and installation instructions from the vendor advisory. Maintaining up-to-date patched versions is the primary mitigation. No vendor advisory states that no action is required or that the vulnerability is already mitigated without patching.