External risk intelligence

Oracle WebLogic Server SOAP Vulnerability Allows Unauthenticated Server Takeover

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-60294

Oracle WebLogic Server is an enterprise application server frequently deployed as a public-facing web or API endpoint. This vulnerability specifically involves the SOAP protocol, a common web service communication method, and allows for unauthenticated remote access, making it highly likely to be reachable via the internet in standard deployment configurations.

Missing Authentication

Oracle Weblogic Server

12.2.1.4.014.1.1.0.014.1.2.0.015.1.1.0.0

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in Oracle WebLogic Server, a widely used enterprise application. This issue, which allows unauthenticated attackers to take complete control of the server via network access, has a high impact on confidentiality, integrity, and availability. The main concern at this stage is confirming if our environment is exposed.

Unauthenticated remote access to servers.
High impact on core business operations.
Confirm relevance and exposure immediately.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker with network access can exploit this vulnerability in Oracle WebLogic Server by sending a specially crafted SOAP message. This bypasses authentication and allows the attacker to interact with the Core component, leading to a complete takeover of the server.

Network access required.
SOAP protocol used to trigger.
Server takeover is the risk.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker with network access to compromise the Oracle WebLogic Server. Successful attacks could lead to a full takeover of the server, impacting its confidentiality, integrity, and availability.

Oracle WebLogic Server.
Unauthenticated network access via SOAP.
Takeover of the affected server.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts Oracle WebLogic Server, a core component of Oracle Fusion Middleware. Responsibility for addressing this will likely fall to application owners, infrastructure teams managing the WebLogic instances, and potentially platform or network security teams if the server is exposed externally. The immediate first step is to identify all deployed instances of the affected Oracle WebLogic Server, determine their reachability and business criticality, and then confirm the accountable owner to plan a risk-based remediation strategy.

Own by: Application and Infrastructure Owners.
Verify first: Instance reachability and business criticality.
Action: Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Oracle WebLogic Server?

Oracle WebLogic Server is an enterprise-grade application server used to host and manage Java-based applications. It acts as the backbone for many business services, handling communication between users and backend systems. This specific vulnerability affects the 'Core' component, which is responsible for fundamental server operations.

How does CVE-2026-60294 compromise the server?

This vulnerability represents a flaw where the server fails to properly validate inputs. Because the weakness resides in the core component, it allows an unauthenticated user to send commands that the server executes with high privileges, effectively granting the attacker full control over the application environment and its data.

Do I need special access to trigger CVE-2026-60294?

No, you do not need a user account or special permissions. An attacker only needs network reachability to the server to send a crafted SOAP message. If the server does not support or process SOAP requests, or if those specific endpoints are disabled or blocked at the network level, the attack path cannot be initiated.

Why should I worry about this vulnerability?

Halo Surface Signal indicates that WebLogic servers are often deployed as public-facing endpoints, making them highly reachable. If your instance is accessible from the internet, it is at higher risk. Even internal servers are vulnerable if an attacker gains access to your corporate network, as the flaw does not require prior authentication.

How should I respond to this threat?

Start by identifying all deployed instances of the affected versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0). Once identified, determine which instances are business-critical or reachable from outside your network. Coordinate with your infrastructure and application owners to prioritize these servers for security updates provided by Oracle.

References

www.oracle.com/security-alerts/cpujul2026.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.