This vulnerability in Oracle WebLogic Server's core component allows an unauthenticated attacker with network access via T3 and IIOP protocols to compromise the server, potentially resulting in full takeover. The affected versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The CVSS 3.1 base score is 8.1, indicating high severity with impacts on confidentiality, integrity, and availability. The vulnerability is classified under CWE-306 (Missing Authentication for Critical Function). Oracle's July 2026 Critical Patch Update advisory references this vulnerability among 1449 patches but does not explicitly confirm patch availability or remediation level for this specific issue. Oracle strongly recommends applying security patches promptly to mitigate such vulnerabilities.

Successful exploitation can lead to complete compromise of Oracle WebLogic Server, affecting confidentiality, integrity, and availability of the system. An unauthenticated attacker with network access via T3 or IIOP protocols could take over the server, potentially leading to unauthorized control and data breaches.

Oracle has released a Critical Patch Update in July 2026 that addresses this vulnerability among many others. While the advisory does not explicitly confirm the patch status for CVE-2026-60312, Oracle strongly recommends that customers apply the latest security patches without delay and remain on actively supported versions. Patch status is not yet confirmed explicitly for this vulnerability—check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance.