CVE-2026-60680 is a vulnerability in the Core component of Oracle WebLogic Server within Oracle Fusion Middleware. It is exploitable by a low privileged attacker with network access via HTTP and can result in unauthorized modification or deletion of critical data and cause denial of service by crashing the server. The CVSS 3.1 base score is 8.1, indicating high severity with impacts on integrity and availability. The affected versions explicitly stated are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. Oracle has included fixes for this vulnerability in their August 2026 Critical Security Patch Update, which contains numerous security patches across multiple Oracle products. Oracle strongly recommends applying these patches without delay.

Exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical data or all data accessible by Oracle WebLogic Server. Additionally, it can cause the server to hang or crash repeatedly, resulting in a complete denial of service. The vulnerability affects the integrity and availability of the server but does not impact confidentiality according to the CVSS vector.

Oracle has released security patches for this vulnerability in the August 2026 Critical Security Patch Update. Customers should apply these official patches promptly to remediate the vulnerability. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to prevent exploitation. No alternative mitigations or workarounds are indicated in the advisory.