{"id":2834,"date":"2026-08-19T07:44:24","date_gmt":"2026-08-19T14:44:24","guid":{"rendered":"https:\/\/www.cycognito.com\/blog\/?p=2834"},"modified":"2026-08-19T07:44:51","modified_gmt":"2026-08-19T14:44:51","slug":"emerging-threat-cve-2026-60702-oracle-weblogic-server-takeover-via-t3-and-iiop","status":"publish","type":"post","link":"https:\/\/www.cycognito.com\/blog\/emerging-threat-cve-2026-60702-oracle-weblogic-server-takeover-via-t3-and-iiop\/","title":{"rendered":"Emerging Threat: (CVE-2026-60702) Oracle WebLogic Server Takeover via T3 and IIOP"},"content":{"rendered":"\n
\"CVE-2026-60702\"
Sample of assets impacted by Oracle takeover vulnerability, identified by the CyCognito Platform<\/em><\/figcaption><\/figure>\n\n\n\n

What is CVE-2026-60702?<\/h2>\n\n\n\n

CVE-2026-60702 is a vulnerability in the Core component of Oracle WebLogic Server, part of Oracle Fusion Middleware, that allows a low-privileged attacker with network access over the T3 or IIOP protocols to compromise the server. Oracle published the issue on August 18, 2026, as part of its August 2026 Critical Security Patch Update.<\/p>\n\n\n\n

The vulnerability carries a CVSS v3.1 base score of 9.9 (Critical). Oracle describes it as easily exploitable, with network attack vector, low attack complexity, and no user interaction required.<\/p>\n\n\n\n

Exploitation is post-authentication, but only barely. The privileges required are low, meaning any account able to reach the T3 or IIOP listener is sufficient. There is no requirement for administrative rights, and no second user needs to be tricked into acting.<\/p>\n\n\n\n

Successful exploitation results in takeover of the WebLogic Server instance. The CVSS scope metric is marked as changed, and Oracle notes that while the flaw sits in WebLogic Server, attacks may significantly impact additional products. In practice that means the blast radius extends past the application server itself to whatever Fusion Middleware or business applications sit on top of it.<\/p>\n\n\n\n

What assets are affected by CVE-2026-60702?<\/h2>\n\n\n\n

Oracle lists four affected versions: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. That range is worth noting, because it spans both the long-lived 12.2.1.4.0 deployments still common in enterprise estates and 15.1.1.0.0, the current generation. This is not a legacy-only exposure.<\/p>\n\n\n\n

The attack path runs over T3 and IIOP, WebLogic’s remote invocation protocols rather than plain HTTP. T3 is enabled by default and shares the same listener as the HTTP interface, which is the detail that turns this into an external exposure problem. An organization that publishes a WebLogic managed server or administration console on TCP\/7001<\/code> or TCP\/7002<\/code> has usually published the T3 listener alongside it, whether or not that was the intent.<\/p>\n\n\n\n

In practice, an affected asset looks like an application server underpinning something else: Oracle Identity Manager, SOA Suite, WebCenter, a PeopleSoft or E-Business Suite front end, or a bespoke Java application inherited through an acquisition or an outsourced build. These deployments tend to be long-lived, tightly coupled to the applications they host, and slow to patch because the middleware version is pinned by the software running on it. They are also frequently owned by a platform team rather than the security team, which is how they end up internet-facing without anyone treating them as an internet-facing asset.<\/p>\n\n\n\n

What does our data show about exposure patterns?<\/h2>\n\n\n\n
\"\"<\/figure>\n\n\n\n

Exposure in this set is led by Industrials at 33.6% of observed assets, with Information Technology contributing 30.2%. The assets behind these shares were identified across multiple sectors and geographies, predominantly by service fingerprint rather than by confirmed version detection, so they should be read as potentially affected assets observed running the software rather than as confirmed vulnerable instances.<\/p>\n\n\n\n

The concentration in Industrials tracks with how that sector operates. Manufacturing, capital goods, and commercial services organizations run distributed site-level infrastructure, carry long equipment and software lifecycles, and integrate heavily with suppliers and contractors. <\/p>\n\n\n\n

Java middleware sits underneath a large share of the ERP, logistics, and supplier portal systems those integrations depend on, and the applications on top of it are often too brittle or too business-critical to upgrade on a vendor’s schedule. <\/p>\n\n\n\n

Information Technology’s showing reflects a different driver: service providers and software vendors run WebLogic on behalf of clients, which multiplies the number of instances and distributes ownership across contract boundaries.<\/p>\n\n\n\n

The wider cross-sector spread points at a visibility problem rather than a patching problem. WebLogic is rarely deployed as a product in its own right. It arrives underneath something else, gets recorded in the asset inventory as that something else, and its remote invocation protocols are never inventoried at all. An organization that knows exactly which applications it runs can still be unaware that it is exposing T3 to the internet on the same port that serves its login page.<\/p>\n\n\n\n

Are fixes available?<\/h2>\n\n\n\n

Yes. Oracle addressed CVE-2026-60702 in its August 2026 Critical Security Patch Update, released on August 18, 2026, alongside patches for a large number of other issues across the Oracle product line. WebLogic Server patches are delivered through the Fusion Middleware patch set rather than as a standalone fix.<\/p>\n\n\n\n

Two caveats matter for planning. Oracle’s Critical Security Patch Update patches are cumulative, so applying the August 2026 set also brings in prior fixes, but skipping intermediate updates does not reduce the testing burden for the applications running on top. Separately, Oracle provides these patches only for product versions covered under the Premier Support or Extended Support phases of its Lifetime Support Policy. Instances running versions older than 12.2.1.4.0 are outside that window and will not receive a fix at all.<\/p>\n\n\n\n

Defenders should confirm patch availability for their specific version and support tier directly with Oracle rather than assuming coverage, and should treat any out-of-support WebLogic instance as permanently unpatched.<\/p>\n\n\n\n

Are there any other recommended actions to take?<\/h2>\n\n\n\n

Until patching is confirmed, defenders should:<\/p>\n\n\n\n