CVE-2026-60977 Oracle Corporation CVE debrief

Who should care

Administrators and security teams responsible for Oracle WebLogic Server instances should review and apply the necessary security patches to prevent potential attacks. They should also implement network access controls, monitor logs, and consider compensating controls. Vulnerability management and security teams should prioritize patching and verify affected deployments.

Technical summary

The CVE-2026-60977 vulnerability is a critical issue in Oracle WebLogic Server, allowing unauthenticated attackers with network access via RMI to compromise the server. The vulnerability has a CVSS score of 9.8 and affects versions 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0. Successful attacks can result in takeover of Oracle WebLogic Server. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Defensive priority

Oracle WebLogic Server vulnerability with a CVSS score of 9.8, allowing unauthenticated attackers to compromise the server via RMI.

Recommended defensive actions

• Review and apply Oracle's security patches for WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0.
• Implement network access controls to restrict RMI access to WebLogic Server.
• Monitor WebLogic Server logs for suspicious activity.
• Consider implementing compensating controls, such as Web Application Firewalls (WAFs), to detect and prevent attacks.
• Perform regular vulnerability scans and inventory checks to ensure WebLogic Server instances are up-to-date and patched.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Evidence notes

The CVE-2026-60977 vulnerability affects Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0. The CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This critical issue allows unauthenticated attackers with network access via RMI to compromise the server, potentially leading to takeover. Evidence is limited to public sources and may not reflect the full scope or impact. Defenders should verify affected deployments, review official advisories, and apply patches or mitigations as needed.

Official resources