ORACLE WebLogic Server is affected by a newly disclosed flaw tracked as CVE-2026-60206 that lets an attacker gain full control of an unpatched system without needing any credentials. The bug was released as part of Oracle’s July 2026 Critical Patch Update and carries a CVSS score of 9.9, marking it as a critical remote code execution risk.
The vulnerability stems from insufficient validation of user‑supplied data during T3 protocol handling, allowing a maliciously crafted request to trigger unsafe deserialization. Successful exploitation grants the attacker the same privileges as the WebLogic process, typically leading to complete server compromise. Oracle notes that the flaw can be exploited remotely without authentication, which is reflected in its CVSS 9.9 rating.
The issue impacts all currently supported versions of WebLogic Server that have not received the July 2026 CPU patch. Organisations that continue to run legacy releases are especially exposed because the flaw does not require any form of user interaction or privileged access.
At the time of writing there have been no confirmed reports of CVE-2026-60206 being exploited in the wild, and no threat actor has been linked to the flaw. Nevertheless, the vulnerability appears in a quarterly update that patched more than 1,400 security issues, highlighting the scale of the company’s remediation effort.
SecurityOnline reported that the flaw is present in WebLogic’s core server component and can be triggered over the network without needing valid credentials. Because WebLogic is frequently deployed in public‑facing middleware tiers, the flaw represents an attractive target for opportunistic scans once details become widely known.
Administrators should download and install the July 2026 Critical Patch Update from Oracle’s support portal as soon as possible. Where immediate patching is not feasible, blocking external access to the T3 port or restricting it to known management networks can reduce risk. Continuous monitoring of T3 traffic for anomalous patterns, combined with network segmentation and web‑application firewall rules, helps detect any attempted exploitation before it succeeds.