CVE-2026-60291 Oracle Corporation CVE debrief

Who should care

Organizations using Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 should prioritize patching this vulnerability to prevent potential server compromise. Operators, platform administrators, vulnerability management teams, and security teams should review the vulnerability and plan for remediation.

Technical summary

The vulnerability, tracked as CVE-2026-60291, is located in the Core component of Oracle WebLogic Server. It has a CVSS 3.1 Base Score of 9.8, indicating critical severity. The vulnerability allows unauthenticated attackers with network access via HTTP to compromise Oracle WebLogic Server, potentially leading to takeover. The CVSS Vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Affected versions include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0.

Defensive priority

High

Recommended defensive actions

• Apply the latest security patches for Oracle WebLogic Server
• Implement network access controls to restrict HTTP access to WebLogic Server
• Monitor WebLogic Server logs for suspicious activity
• Consider implementing a Web Application Firewall (WAF) to detect and prevent exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-07-21T22:17:31.603Z and was last modified on 2026-07-25T05:16:37.250Z. The NVD entry is currently Undergoing Analysis. Oracle has provided a security alert for this vulnerability (reference: [email protected]). Additional verification is recommended to confirm affected deployments and validate vendor guidance.

Official resources