/DISPATCH · 2026-07-31

CVE-2026-60204: Oracle WebLogic Server Unauthenticated RCE

Oracle July CPU patches a critical WebLogic Server Core flaw. Unauthenticated attackers can fully take over servers via T3/IIOP. CVSS 9.8.

Incident Overview

21 Jul 2026: Oracle shipped the July Critical Patch Update (CPU). CVE-2026-60204 is a critical flaw in Oracle WebLogic Server Core. Unauthenticated attackers can remotely take over affected instances via T3 or IIOP. No user interaction. No credentials.

Technical Details

Root Cause

Flaw lives in WebLogic Server Core. Exploit path:

Protocol: T3 (default TCP 7001) or IIOP (default TCP 7002)
Auth: none (PR:N)
User interaction: none (UI:N)
Complexity: low (AC:L)

IONIX Threat Research rates it easy to exploit. Any attacker with network access can trigger it.

Affected Versions

Oracle WebLogic Server 12.2.1.4.0
Oracle WebLogic Server 14.1.1.0.0
Oracle WebLogic Server 14.1.2.0.0
Oracle WebLogic Server 15.1.1.0.0

Impact Assessment

| Metric | Rating | | --- | --- | | CVSS 3.1 Base Score | 9.8 (Critical) | | Attack Vector | Network (AV:N) | | Confidentiality Impact | High (C:H) | | Integrity Impact | High (I:H) | | Availability Impact | High (A:H) |

CISA-ADP SSVC: automatable: yes / technicalImpact: total. Automated attack tools likely soon.

Remediation

Immediate Actions

Patch: get and install the matching July CPU patch now
Network isolation: if you cannot patch immediately, restrict T3/IIOP ports (7001/7002) to trusted networks only
Disable protocols: fully disable T3 and IIOP on internet-facing nodes if business allows

Detection Rules

# Monitor anomalous T3/IIOP connections
iptables -A INPUT -p tcp --dport 7001 -m recent --set --name weblogic_t3
iptables -A INPUT -p tcp --dport 7001 -m recent --update --seconds 60 \
    --hitcount 10 --name weblogic_t3 -j LOG --log-prefix "WEBLOGIC_SCAN: "

References

Oracle July 2026 Critical Patch Update Advisory
CVE-2026-60204 NIST NVD
IONIX Threat Center CVE-2026-60204 analysis