CVE-2026-60294 is a critical security vulnerability in Oracle WebLogic Server's core component that allows an unauthenticated attacker with network access via SOAP to compromise the server. The vulnerability affects versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. It has a CVSS 3.1 base score of 9.8 with attack vector network, low attack complexity, no privileges required, no user interaction, and impacts confidentiality, integrity, and availability at a high level. Successful exploitation can result in full takeover of the Oracle WebLogic Server. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others and recommends applying security patches without delay. However, the advisory does not explicitly confirm the availability of a patch for this specific CVE, so users should verify patch availability and remediation instructions directly from Oracle's advisory.

This vulnerability allows an unauthenticated remote attacker to fully compromise Oracle WebLogic Server, impacting confidentiality, integrity, and availability. The attacker can take over the server, potentially leading to unauthorized access, data breaches, and service disruption. The CVSS score of 9.8 reflects the critical nature and ease of exploitation over the network without any privileges or user interaction.

Oracle has released a Critical Patch Update in July 2026 that addresses multiple vulnerabilities including this one. Users should promptly review the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html and apply the relevant patches to affected Oracle WebLogic Server versions. Patch status for CVE-2026-60294 is not explicitly confirmed; therefore, users must verify patch availability and installation instructions in the vendor advisory. Maintaining up-to-date patched versions is strongly recommended to mitigate this vulnerability.