Description
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SOAP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-07-21
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An unauthenticated attacker can use SOAP over the network to execute code and fully take control of Oracle WebLogic Server. The flaw is caused by missing authentication checks before processing SOAP requests, a classic instance of CWE-306. This results in confidentiality, integrity, and availability impacts.

Affected Systems

Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 are affected.

Risk and Exploitability

The CVSS score of 9.8 indicates extreme severity, and the EPSS score of less than 1% suggests a low exploitation probability at this time. The vulnerability is not listed in the CISA KEV catalog. The likely exploitation path involves an unauthenticated network connection to the SOAP service; the flaw can be leveraged to gain any access the WebLogic service itself has, potentially compromising the entire server.

Generated by OpenCVE AI on August 2, 2026 at 22:58 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest Oracle security patch for WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0.
  • If patching cannot occur immediately, isolate the affected WebLogic instance from untrusted networks using firewall rules or network segmentation.
  • Configure the server to limit SOAP access to trusted management networks or disable the SOAP interface if it is not required for business operations.

Generated by OpenCVE AI on August 2, 2026 at 22:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 02 Aug 2026 23:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated SOAP Authentication Bypass in Oracle WebLogic Server Enables Full Server Takeover

Thu, 30 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via Unauthenticated SOAP Access in Oracle WebLogic Server
Weaknesses CWE-287

Fri, 24 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200 CWE-306

Fri, 24 Jul 2026 01:15:00 +0000

Type Values Removed Values Added
Title Remote Code Execution via Unauthenticated SOAP Access in Oracle WebLogic Server
Weaknesses CWE-287

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SOAP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle weblogic Server
CPEs cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:weblogic_server:14.1.2.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:weblogic_server:15.1.1.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle weblogic Server
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Weblogic Server
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-25T03:56:06.895Z

Reserved: 2026-07-08T15:51:40.528Z

Link: CVE-2026-60294

cve-icon Vulnrichment

Updated: 2026-07-23T18:34:48.447Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-02T23:00:04Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function