CVE-2026-60313 is a vulnerability in the Core component of Oracle WebLogic Server that permits a low privileged attacker with network access via RMI to compromise the server. The vulnerability affects versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The CVSS 3.1 base score is 8.8, indicating high severity with impacts on confidentiality, integrity, and availability. The vulnerability is easily exploitable and can result in complete takeover of the Oracle WebLogic Server. Oracle’s July 2026 Critical Patch Update advisory references this vulnerability among many others and advises customers to apply patches without delay. However, the advisory does not explicitly confirm the patch status for this CVE, so users must verify patch availability in the official update documentation.

Successful exploitation of this vulnerability allows an attacker with low privileges and network access via RMI to fully compromise Oracle WebLogic Server. This includes complete loss of confidentiality, integrity, and availability of the affected system, potentially leading to full server takeover.

Oracle’s July 2026 Critical Patch Update advisory includes security patches addressing this vulnerability among others. Customers are strongly advised to remain on actively supported versions and apply the Critical Patch Update patches promptly. Patch status for this specific vulnerability is not explicitly confirmed in the advisory; therefore, users should consult the official Oracle Critical Patch Update documentation at https://www.oracle.com/security-alerts/cpujul2026.html for detailed patch availability and installation instructions. No alternative mitigations or temporary fixes are stated.