External risk intelligence

Oracle WebLogic Server SOAP Takeover Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-60200

Oracle WebLogic Server is an enterprise application server frequently deployed as a public-facing web or API endpoint. This vulnerability is reachable via unauthenticated network access using the SOAP protocol, which is a common communication method for internet-exposed middleware services.

Missing Authentication

Oracle Weblogic Server

12.2.1.4.014.1.1.0.014.1.2.0.015.1.1.0.0

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in Oracle WebLogic Server, a widely used enterprise application server, could allow an unauthenticated attacker to take control of the system. This issue is considered critical due to its potential for significant impact on confidentiality, integrity, and availability. The main concern is confirming relevance and exposure to our deployed instances.

Unauthenticated attackers can fully control the server.
Confirms exposure and relevance to our systems.
Assess and address potential operational risk.

Attack Path

How an attacker could exploit the issue

An attacker could reach this vulnerability by sending specially crafted requests over the network using the SOAP protocol. Since no authentication is required, an attacker with network access can target the Core component of Oracle WebLogic Server. Successful exploitation could lead to a complete takeover of the server.

Unauthenticated network access required.
Triggered via SOAP protocol to the Core component.
Risk of complete server takeover.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker with network access could compromise Oracle WebLogic Server through a vulnerability exploitable via SOAP. Successful attacks may lead to a complete takeover of the server, impacting its confidentiality, integrity, and availability.

Server takeover.
Network access via SOAP.
Full server compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Oracle WebLogic Server requires immediate attention from application owners, infrastructure teams, and potentially vendor management. The first practical step is to identify all instances of the affected Oracle WebLogic Server, determine their network exposure and business criticality, and then assign ownership for remediation.

Own the issue: Application or Infrastructure teams.
Verify first: Network exposure and business criticality.
Action: Plan and coordinate remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Oracle WebLogic Server?

Oracle WebLogic Server is an enterprise-grade application server used to host and manage Java-based applications. It acts as the backbone for business services, handling communication between users and backend systems. Because it manages critical application logic and data, it is commonly found in corporate environments that require robust middleware to process requests and execute enterprise workflows.

What does this CVE-2026-60200 vulnerability mean?

This is a severe security flaw in the core component of WebLogic that enables an unauthorized party to gain total control over the server. Technically, it represents a breakdown in how the system processes incoming data, allowing an attacker to bypass security checks entirely. The vulnerability affects the integrity and availability of the server, meaning someone could potentially access, modify, or disrupt the data and services hosted on the system.

How can an attacker trigger this vulnerability?

An attacker triggers this bug by sending a specifically formatted message using the SOAP protocol directly to the WebLogic server. Because the vulnerability exists in the core component, it does not require a valid username or password to work. Please note that normal, legitimate SOAP traffic used for standard application functions will not trigger this issue; only requests containing the malicious payload designed to exploit this specific flaw will cause the compromise.

Is my Oracle WebLogic Server at risk?

According to Halo Surface Signal, this vulnerability is particularly relevant to instances that are reachable from the public internet. Since the flaw is exploitable over the network via the SOAP protocol, servers that act as web or API endpoints are the primary targets. If your instance is isolated within a private, internal network without exposure to untrusted traffic, the immediate risk profile is different compared to systems exposed directly to the internet.

Do I need to patch my systems immediately?

The first step is to perform an inventory of all your Oracle WebLogic Server instances to determine which ones are running the affected versions. Once you have identified them, prioritize those with external network access or high business importance. Coordinate with your infrastructure and application teams to verify the specific configuration of these servers and plan the necessary software updates provided by the vendor.

References

www.oracle.com/security-alerts/cpujul2026.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.