External risk intelligence

Oracle WebLogic Server Core Vulnerability Allows Server Takeover

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-60198

Oracle WebLogic Server is frequently deployed as an internet-facing application server or middleware layer to host web applications and APIs. While T3 and IIOP protocols are often restricted, the product is commonly exposed to the internet to support its primary role as a gateway or service endpoint, making it a frequent target for remote network access.

Missing Authentication

Oracle Weblogic Server

12.2.1.4.014.1.1.0.014.1.2.0.015.1.1.0.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Oracle WebLogic Server, a component used in Oracle Fusion Middleware. This issue, if exploited by an unauthenticated attacker over the network, could allow for a complete takeover of the affected server, impacting confidentiality, integrity, and availability.

A severe server compromise is possible.
Oracle WebLogic Server is a common gateway for business applications.
Confirm if your Oracle WebLogic Server is exposed and assess risk.

Attack Path

How an attacker could exploit the issue

An attacker could compromise Oracle WebLogic Server by sending specially crafted network requests through T3 or IIOP protocols. This vulnerability requires no prior authentication and can be exploited remotely, potentially leading to a complete takeover of the affected server.

Attacker gains network access.
Attacker sends malicious network requests.
Complete server takeover is possible.

Live Threat

Current exploitation, exposure, and threat context

Unauthenticated attackers with network access to Oracle WebLogic Server via T3 or IIOP could potentially gain complete control of the server. This could impact the confidentiality, integrity, and availability of the system and any data it processes.

Oracle WebLogic Server system.
Network access via T3, IIOP.
Takeover of the server.

Operational Fix

Recommended remediation, mitigation, and detection steps

Given that Oracle WebLogic Server is often deployed as an internet-facing application server, the platform or infrastructure teams are likely responsible for addressing this vulnerability. The first practical step is to identify all instances of Oracle WebLogic Server, confirm their network accessibility and business criticality, and then assign ownership for remediation planning based on the assessed risk.

Platform or infrastructure teams own remediation.
Verify network exposure and business criticality.
Plan and execute risk-based patching or mitigation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Oracle WebLogic Server?

Oracle WebLogic Server is an application server used to host and manage enterprise Java applications. It functions as a middleware layer, often acting as a gateway or service endpoint that allows business applications to communicate and perform tasks across a network.

What does CVE-2026-60198 mean for the server?

This vulnerability represents a flaw where an unauthorized user can send malicious commands to the system. It is a critical security weakness that could allow an attacker to gain complete control over the application server, compromising the confidentiality, integrity, and availability of the data and services it manages.

How is this vulnerability triggered?

The issue is triggered when an attacker sends specially crafted network requests to the server using the T3 or IIOP protocols. Crucially, the attacker does not need to provide any login credentials to succeed. If these specific protocols are disabled or inaccessible to the attacker, the primary path for this specific attack is removed.

Do I need to worry if my server is internal?

Halo Surface Signal indicates that Oracle WebLogic Server is frequently deployed as an internet-facing gateway, making it a common target. If your server is hosted within an internal network and not exposed to the internet, it is less likely to be reached by external attackers, though internal network security should still be maintained.

When should I take action for CVE-2026-60198?

You should begin by locating every instance of Oracle WebLogic Server in your environment to determine which are running the affected versions. After identifying these assets and confirming their network access, coordinate with your infrastructure team to prioritize these servers for risk-based patching or other security mitigations as defined by Oracle.

References

www.oracle.com/security-alerts/cpujul2026.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.