External risk intelligence

Oracle WebLogic Server Core Takeover Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-60291

Oracle WebLogic Server is an enterprise application server frequently deployed as a public-facing web or API endpoint. Because this vulnerability is reachable via HTTP without authentication, it is highly likely to be exposed to the public internet in common deployment patterns.

Missing Authentication

Oracle Weblogic Server

12.2.1.4.014.1.1.0.014.1.2.0.015.1.1.0.0

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Oracle WebLogic Server, an enterprise application server that may be exposed externally. This issue could allow an unauthenticated attacker to gain complete control of the server, potentially impacting confidentiality, integrity, and availability.

An attacker could take over Oracle WebLogic Servers.
Executive leaders should be aware of critical system vulnerabilities.
Confirm relevance and understand potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could compromise Oracle WebLogic Server by sending network requests over HTTP. This vulnerability in the Core component allows an unauthenticated individual with network access to gain control of the server. Successful exploitation could lead to a full takeover of the affected Oracle WebLogic Server, impacting confidentiality, integrity, and availability.

Network access via HTTP required.
Vulnerable Core component triggered.
Complete server takeover is possible.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker with network access to gain complete control of an affected Oracle WebLogic Server. This means an attacker could potentially access, modify, or delete sensitive system data and disrupt service operations.

Oracle WebLogic Server.
Network access via HTTP.
Complete server takeover.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-World Ownership

This critical vulnerability in Oracle WebLogic Server requires immediate attention from teams responsible for application security and infrastructure management. The first practical step is to identify all instances of the affected Oracle WebLogic Server product, confirm their exposure and business criticality, and then assign ownership to the appropriate team for risk-based remediation planning.

Assign ownership to platform or application teams.
Verify all Oracle WebLogic Server instances.
Plan remediation based on business criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Oracle WebLogic Server?

Oracle WebLogic Server is an enterprise-grade application server used to build, deploy, and run large-scale Java applications. It functions as a middleware platform that manages resources, connects databases, and handles HTTP traffic, acting as the backbone for critical business services and API endpoints.

What does this vulnerability mean for Oracle WebLogic Server?

This flaw allows an attacker to bypass authentication mechanisms to gain complete control over the application server. Because the weakness resides in the Core component, it compromises the entire system's integrity, confidentiality, and availability, essentially granting the attacker the same level of access as the server administrator.

How can an attacker trigger this CVE-2026-60291 vulnerability?

An attacker triggers this issue by sending specially crafted HTTP requests to the target Oracle WebLogic Server. No credentials or prior user interaction are required for the exploit to succeed. Notably, local access is not necessary; the vulnerability is reachable as long as the server can be reached over a network.

Is my Oracle WebLogic Server at risk?

Halo Surface Signal indicates that because this vulnerability is reachable over HTTP without authentication, Oracle WebLogic Server instances deployed as public-facing web or API endpoints are at high risk. Servers exposed directly to the internet are more readily accessible to potential attackers than those restricted to internal network segments.

What is the first step to address this Oracle WebLogic Server issue?

Begin by creating an accurate inventory of all Oracle WebLogic Server instances across your environment. Once identified, verify their current network accessibility and determine which systems serve public-facing traffic. Assign clear ownership to the teams managing these specific servers so they can prioritize remediation based on the business importance of each instance.

References

www.oracle.com/security-alerts/cpujul2026.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.