External risk intelligence

Oracle WebLogic Server Core Takeover Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-60672

Oracle WebLogic Server is frequently deployed as an internet-facing application server or middle-tier gateway. The vulnerability is accessible via T3 and IIOP protocols without authentication, which are core components often exposed or reachable in standard enterprise web service deployments.

Missing Authentication

Oracle Weblogic Server

12.2.1.4.014.1.1.0.014.1.2.0.015.1.1.0.0

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Oracle WebLogic Server, a component of Oracle Fusion Middleware. This issue is easily exploitable by unauthenticated attackers over the network, potentially leading to a complete takeover of the server. The high CVSS score of 9.8 highlights significant impacts on confidentiality, integrity, and availability.

A serious security flaw affects Oracle WebLogic Server.
Critical systems could be fully compromised remotely.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending malicious requests over the network to an exposed Oracle WebLogic Server. Because the vulnerability doesn't require authentication, an unauthenticated attacker can leverage network access to trigger the flaw, potentially leading to a complete takeover of the server.

Network access required.
Vulnerable server component.
Full server takeover risk.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker with network access to take over the Oracle WebLogic Server. This could affect the confidentiality, integrity, and availability of the server and any data it processes.

Server takeover is at risk.
Unauthenticated network access enables exposure.
Complete compromise of the affected server.

Operational Fix

Recommended remediation, mitigation, and detection steps

Attackers can compromise Oracle WebLogic Server through an easily exploitable vulnerability, potentially leading to a full takeover. Ownership typically falls to the platform or application teams responsible for WebLogic Server deployments. The first practical step is to identify all instances, assess their exposure and business criticality, and then determine the accountable owner for remediation planning.

Platform and application teams own the issue.
Verify exposed and critical WebLogic instances.
Plan remediation based on assessed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Oracle WebLogic Server?

Oracle WebLogic Server is an enterprise-grade application server used to host, deploy, and manage large-scale Java-based web applications. It serves as a middle-tier foundation in Oracle Fusion Middleware environments, facilitating complex business logic and communication between web clients and backend databases.

What does CVE-2026-60672 mean for security?

This vulnerability is a critical flaw within the server's core, categorized as an improper access control issue. Because it allows for complete unauthorized control, an attacker can manipulate, read, or destroy server data and configurations without needing any legitimate login credentials.

How is this vulnerability triggered?

The flaw is triggered when an attacker sends malicious data packets to the server using the T3 or IIOP protocols. It does not require any prior user authentication or specific user interaction. Conversely, requests that do not utilize these specific protocols for communication do not trigger this vulnerability.

Is my Oracle WebLogic Server at risk?

According to Halo Surface Signal, this vulnerability is very likely to pose a risk if your server is internet-facing or reachable via standard network pathways. Since WebLogic is often deployed as a gateway or public-facing service, environments with T3 or IIOP ports open to the broader network are at the highest level of concern.

How should I respond to this threat?

Start by identifying all deployed instances of Oracle WebLogic Server within your environment. Once mapped, assess which instances are business-critical and internet-accessible. Coordinate with your platform or application teams to prioritize these servers for remediation planning based on their specific risk profile.

References

www.oracle.com/security-alerts/cspuaug2026.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.