CVE-2026-60198 and four siblings let an unauthenticated attacker take over Oracle WebLogic Server over T3, IIOP, HTTP or SOAP. Five critical holes, one July patch — here's what to do.
If you run Oracle WebLogic Server, the July Critical Patch Update isn't optional. Oracle fixed five separate CVSS 9.8 flaws in WebLogic's core, each of which lets a remote, unauthenticated attacker take over the server — no password, no click, just network access. CVE-2026-60198 and its siblings CVE-2026-60202 and -60204 hit over the T3 and IIOP protocols; -60199 comes over HTTP; -60200 over SOAP. Different doors, same result: full compromise of the server and everything it can reach.
0.0/ 10
CVSS severity: Critical
Unauthenticated, network-based, full takeover — across five separate WebLogic flaws.
Why WebLogic keeps getting hit over T3
WebLogic's T3 and IIOP protocols are how Java clients talk to the server, and they've been a recurring source of deserialization and authentication flaws for years — the same lineage as past headline WebLogic bugs. The problem is that these protocols are often left exposed, sometimes to the open internet, when they should only be reachable from trusted application tiers. An unauthenticated flaw in a protocol that's listening for network connections is the worst-case combination, and it's exactly the profile of these five. The parallel to the Ivanti Sentry perfect-10 is direct: internet-facing enterprise middleware, unauthenticated RCE, immediate priority.
WebLogic runs the middleware tier of countless enterprises — which is exactly why an unauthenticated takeover is so dangerous. · Unsplash
What to do
Apply the July 2026 Oracle Critical Patch Update to WebLogic 12.2.1.4, 14.1.1, 14.1.2 and 15.1.1 immediately.
Restrict T3 and IIOP access to trusted networks only — these protocols should never face the internet.
Put WebLogic behind a firewall/WAF and limit which hosts can reach the admin protocols.
Because these are pre-auth, hunt for signs of prior compromise if the server was internet-exposed.
Quick answers
Which WebLogic versions are affected?
CVE-2026-60198 and its siblings affect WebLogic Server 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. All are fixed in the July 2026 Critical Patch Update. If you run any of these versions with T3, IIOP, HTTP or SOAP endpoints reachable, patch immediately — the flaws are unauthenticated, so no attacker credentials are needed.
Are these being exploited?
WebLogic pre-auth RCEs are historically weaponized quickly because the software is widely deployed and often internet-exposed. Treat these as high-priority regardless of current exploitation status — the combination of 'unauthenticated', '9.8', and 'five separate flaws' is exactly what attackers scan for. Patch now rather than waiting for confirmation of in-the-wild use.
Can I mitigate without patching?
You can reduce exposure by restricting T3/IIOP to trusted networks and firewalling the admin protocols, which blocks the most common attack path. But with five separate flaws across multiple protocols, mitigations are incomplete — the July CPU is the real fix. Use network restrictions as a stopgap while you schedule the patch, not as a permanent substitute.
Five unauthenticated 9.8s in one product is a stop-everything event for WebLogic operators. Patch to the July CPU, lock down T3/IIOP, and treat any internet-exposed instance as suspect. Sources: NVD and Oracle's CPU. It joins the month's other infrastructure emergencies — the DHCP RCE and Ivanti 10.0 — as bugs where exposure plus unauthenticated access equals urgency.
