This vulnerability in Oracle WebLogic Server (Console component) affects versions 14.1.2.0.0 and 15.1.1.0.0. It is exploitable by an unauthenticated attacker who has logon access to the infrastructure hosting the server. The vulnerability allows compromise of the WebLogic Server, potentially leading to unauthorized access to critical or all data accessible by the server. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) indicates that the attack requires local access with low complexity and no privileges or user interaction, with a scope change and high confidentiality impact. The vulnerability may also affect additional Oracle products due to scope change. No known exploits in the wild have been reported. The vendor advisory does not explicitly state a patch or remediation level for this specific CVE but references the July 2026 Critical Patch Update containing numerous patches across Oracle products.

Successful exploitation results in unauthorized access to critical or all data accessible by Oracle WebLogic Server, compromising confidentiality. There is no impact on integrity or availability. The attack requires local access (logon to the infrastructure) but no privileges or user interaction. The vulnerability may also impact other Oracle products due to scope change.

Patch status is not yet confirmed for this specific vulnerability; the vendor advisory references the July 2026 Critical Patch Update containing many patches but does not explicitly confirm a fix for CVE-2026-60527. Customers should consult the Oracle Critical Patch Update Advisory for July 2026 for patch availability and apply relevant patches promptly. Oracle strongly recommends remaining on actively-supported versions and applying security patches without delay. No vendor advisory states that no action is required or that the vulnerability is already mitigated.