Description
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebLogic Server accessible data as well as unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-07-21
Score: 9.1 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability allows an unauthenticated attacker who can reach the server over HTTP to create, delete, or modify critical data in Oracle WebLogic Server. The attacker can also obtain unauthorized read access to all data that the server exposes. The impact is limited to confidentiality and integrity, with no availability loss. According to the CVSS vector, the flaw is high severity with a base score of 9.1.

Affected Systems

Oracle WebLogic Server releases 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 are documented as affected. Any installation of one of these versions that is reachable via HTTP is potentially vulnerable.

Risk and Exploitability

The CVSS score of 9.1 indicates high severity. The EPSS score of less than 1% signals a low but non‑zero likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is network-based with no authentication or user interaction required, meaning an attacker with network access to the WebLogic Server could exploit the flaw by sending a crafted HTTP request.

Generated by OpenCVE AI on August 2, 2026 at 23:26 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Oracle WebLogic Server patch or upgrade to a non‑affected version in accordance with the vendor’s advisory
  • Restrict HTTP access to the WebLogic Server through firewall rules or network segmentation so that only trusted hosts can reach the service
  • Configure WebLogic to enforce authentication and TLS for all management interfaces, eliminating unauthenticated HTTP access

Generated by OpenCVE AI on August 2, 2026 at 23:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 02 Aug 2026 23:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Data Manipulation in Oracle WebLogic Server

Mon, 27 Jul 2026 14:15:00 +0000

Type Values Removed Values Added
Title Remote Unauthorized Data Manipulation in Oracle WebLogic Servers
Weaknesses CWE-79
CWE-94

Fri, 24 Jul 2026 02:00:00 +0000

Type Values Removed Values Added
Title Remote Unauthorized Data Manipulation in Oracle WebLogic Servers
Weaknesses CWE-79
CWE-94

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebLogic Server accessible data as well as unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle weblogic Server
CPEs cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:weblogic_server:14.1.2.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:weblogic_server:15.1.1.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle weblogic Server
References
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle Weblogic Server
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-25T03:56:09.247Z

Reserved: 2026-07-08T15:51:40.523Z

Link: CVE-2026-60208

cve-icon Vulnrichment

Updated: 2026-07-23T16:00:51.440Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-02T23:30:07Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption