Multiple vulnerabilities affecting Oracle WebLogic Server
Multiple vulnerabilities have been discovered in Oracle WebLogic Server and its associated proxy plugins, allowing an attacker to remotely execute arbitrary code, take control of the server, bypass security mechanisms, and compromise data confidentiality and integrity.
Description
Technical context and vulnerability details
Oracle WebLogic Server is a Java EE application server integrated into the Oracle Fusion Middleware suite, widely deployed within enterprise infrastructures. As part of its July 2026 Critical Patch Update (CPU), Oracle fixed multiple vulnerabilities within the Core component of WebLogic Server, including several classified as critical and exploitable remotely without authentication. Additionally, the Oracle HTTP Server and Oracle WebLogic Server Proxy Plugins are affected by a separate critical vulnerability. All of these vulnerabilities are worded as follows: CVE-2026-21962 (CVSS 10.0): vulnerability in the Proxy Plugins of Oracle HTTP Server and Oracle WebLogic Server for Apache HTTP Server and Microsoft IIS, exploitable remotely and without authentication, allowing bypass of security mechanisms and access to back-end WebLogic systems. CVE-2026-60206 (CVSS 9.9): Vulnerability within the Core component, exploitable via the SAML protocol by an authenticated malicious actor with low privileges, allowing a takeover of the server with a change of scope likely to affect other products. CVE-2026-60198, CVE-2026-60202 and CVE-2026-60204 (CVSS 9.8): Java deserialization vulnerabilities within the Core component, exploitable remotely and without authentication via T3/IIOP protocols, allowing complete takeover of the server. CVE-2026-60199 (CVSS 9.8): vulnerability within the Core component, exploitable remotely and without authentication via the HTTP protocol, allowing takeover of the server. CVE-2026-60200 (CVSS 9.8): vulnerability within the Core component, exploitable remotely and without authentication via the SOAP protocol, allowing compromise of the server. CVE-2026-60208 (CVSS 9.1): vulnerability within the Core component, exploitable remotely and without authentication via the HTTP protocol, affecting confidentiality and data integrity. CVE-2026-60201 (CVSS 8.1): Java deserialization vulnerability within the Core component, exploitable remotely and without authentication via T3/IIOP protocols, with high operating complexity.
Potential Risks & Impact
Potential consequences upon exploitation
- Remote Arbitrary Code Execution;
- Complete system takeover;
- Circumvention of security mechanisms;
- Compromise of system integrity;
- Data privacy breach;
- Breach of data availability;
Affected systems
Products, components and targeted versions
- Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 (Core component);
- Oracle HTTP Server and Oracle WebLogic Server Proxy Plugins for Apache HTTP Server and Microsoft IIS (CVE-2026-21962);
Recommended Remediations & Actions
Immediate actions and recommended mitigations
- Immediately apply Oracle July 2026 Critical Patch Update (CPU) fixes to all affected Oracle WebLogic Server instances;
- Update Oracle HTTP Server and WebLogic Server Proxy Plugins to patched versions;
- Restrict access to WebLogic Server network protocols (T3, IIOP, HTTP, SOAP) to trusted networks only;
- Apply the principle of least privilege to accounts with access to the server;
Sources & External Links
Vendor security advisories and documentation
Advisory Specifications
CSIRT Emergency Response
Is your organization affected or do you suspect an incident? Our security experts are available to assist.
Report an incidentGet our alerts by email
Subscribe to receive our security alert bulletins and Iservices news straight to your inbox.