What are these vulnerabilities?
Oracle’s July 2026 Critical Patch Update fixes multiple vulnerabilities in the Core component of Oracle WebLogic Server. Most of them let an unauthenticated, remote attacker fully take over the server, and they are reachable over WebLogic’s standard network protocols: T3 and IIOP, HTTP, SOAP, and SAML.
Five of the flaws carry a CVSS v3.1 base score of 9.8 (Critical) and allow unauthenticated remote takeover: CVE-2026-60198, CVE-2026-60202, and CVE-2026-60204 over T3/IIOP, CVE-2026-60199 over HTTP, and CVE-2026-60200 over SOAP. The T3/IIOP entries are Java deserialization flaws, the same vulnerability class behind a decade of exploited WebLogic entries in the CISA Known Exploited Vulnerabilities catalog.
Two further issues round out the set. CVE-2026-60206 carries a CVSS v3.1 base score of 9.9 (Critical): it requires only low privileges but changes scope to affect other products, and it is exploitable over SAML. CVE-2026-60208 carries a score of 9.1 (Critical), is unauthenticated over HTTP, and impacts confidentiality and integrity. A final T3/IIOP flaw, CVE-2026-60201, scores 8.1 (High) and is unauthenticated but rated high attack complexity, which narrows practical exploitation.
None of these CVEs are listed in the CISA Known Exploited Vulnerabilities catalog at the time of writing. Given the exploitation history of WebLogic deserialization flaws, the unauthenticated ones warrant priority regardless.
What assets are affected?
The affected software is Oracle WebLogic Server, specifically versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. WebLogic is a Java application server that sits at the back of enterprise web stacks, hosting portals, business applications, and integration endpoints, and it is frequently exposed to the internet through the front-end applications it powers.
In practice, an affected asset is a WebLogic instance whose network listeners are reachable from untrusted networks. The T3, T3S, IIOP, and IIOPS protocols run on the server’s listen ports, commonly TCP/7001 and TCP/7002, and the admin HTTP interface and SOAP and SAML endpoints ride on the same infrastructure. Deserialization flaws in these protocols have been the mechanism behind repeated in-the-wild WebLogic compromises, because the listener accepts and unpacks attacker-supplied serialized objects before any authentication takes place.
Most WebLogic instances on the external attack surface are fingerprinted without an exact version string. This means exposure cannot be scoped by version alone: any internet-reachable WebLogic listener should be treated as potentially in range until its patch level is confirmed against the July 2026 Critical Patch Update.
What does our data show about exposure patterns?
Exposure in this set is led by Industrials at 32.0% of observed assets, with Information Technology close behind at 29.2%. Consumer Discretionary accounts for a further 17.2%.
Industrials over-index here because the sector runs large, distributed operational estates built on long-lived middleware. WebLogic is classic backend infrastructure for supplier portals, logistics systems, and internal business applications, and those deployments tend to outlast the teams that stood them up. Information Technology follows the same logic from a different angle: technology hardware and software organizations embed WebLogic inside product stacks and internal tooling, where instances accumulate and are rarely retired on schedule.
The cross-sector spread points to a visibility problem rather than a single misconfiguration. WebLogic is old enough that many instances predate current asset inventories, and its network listeners are often left reachable long after the applications in front of them have moved on. The result is a population of internet-facing servers that no one is actively tracking, which is precisely the condition that turns a patchable vulnerability into a standing exposure.
Are fixes available?
Yes. Oracle addressed all of these vulnerabilities in the July 2026 Critical Patch Update, published on July 21, 2026. The fixes are available through Oracle’s standard patch delivery for the affected WebLogic Server versions.
WebLogic patches are cumulative, so applying the current Critical Patch Update also carries forward earlier fixes. Organizations running the affected versions should apply the July 2026 update rather than a partial or one-off patch.
Because most external WebLogic instances are fingerprinted without an exact version, defenders should verify patch status directly against each server rather than assuming a given instance is out of range. Treat any unconfirmed internet-facing WebLogic listener as unpatched until checked.
Are there any other recommended actions to take?
Until patch status is confirmed, defenders should:
- Inventory all WebLogic instances reachable from untrusted networks
- Restrict T3, T3S, IIOP, and IIOPS listener ports to trusted management networks
- Restrict the WebLogic admin HTTP interface to trusted management networks
- Configure WebLogic connection filters to reject T3 and IIOP from external sources
- Monitor listener logs for deserialization errors and malformed serialized objects
- Prioritize remediation of the unauthenticated flaws over the low-privilege and high-complexity entries
How can CyCognito help your organization?
CyCognito published an Emerging Threat Advisory for these Oracle WebLogic Server vulnerabilities in the CyCognito platform and is actively researching enhanced detection capabilities for this vulnerability.
To learn how CyCognito can help your organization reduce external exposure and manage emerging threats more effectively, contact us to request a demo.
