PT-2026-62376 · Oracle · Oracle Weblogic Server

CVE-2026-60294

·

Published

2026-07-21

·

Updated

2026-07-28

CVSS v2.0

10

Critical

VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0
Description An issue in the Core component of Oracle Fusion Middleware allows an unauthenticated attacker with network access via SOAP to compromise the server. Successful exploitation can lead to a full takeover of the system.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Missing Authentication

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-200CWE-306

Related Identifiers

BDU:2026-10500
CVE-2026-60294

Affected Products

Oracle Weblogic Server