Oracle WebLogic Server Unauthenticated RCE via T3/IIOP (CVE-2026-60672)
First seen Aug 20, 2026 · Updated Aug 20, 2026 · CVSS 9.8
A critical, easily exploitable vulnerability in Oracle WebLogic Server allows unauthenticated attackers with network access via the T3 or IIOP protocols to fully compromise the server. With a CVSS score of 9.8 and no required user interaction or privileges, this flaw is highly likely to be weaponized rapidly, as historical WebLogic T3/IIOP vulnerabilities have been favored targets for mass exploitation and ransomware precursor activity.
Technical Analysis
The vulnerability resides in the Core component of Oracle WebLogic Server and is reachable over the network through the T3 and IIOP protocols, which are commonly used for RMI-based deserialization attacks in prior WebLogic CVEs (e.g., CVE-2020-14882, CVE-2019-2725). Exploitation requires no authentication or user interaction (AV:N/AC:L/PR:N/UI:N) and yields full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H), typically via unsafe Java deserialization leading to remote code execution. Affected versions include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, spanning both legacy and current enterprise deployments. Organizations that run AI agent orchestration layers, RAG pipelines, or LLM tool-use backends on WebLogic-hosted Java middleware are at direct risk, since a successful takeover could expose embedded API keys, model credentials, and agent configuration data, or allow attackers to pivot into connected agent infrastructure.
Affected Systems
Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0; any deployment exposing T3 or IIOP listener ports to untrusted networks.
Indicators of Compromise
- No public IOCs available at time of disclosure
- Monitor for anomalous T3 protocol handshake attempts on port 7001/7002
- Monitor for unexpected IIOP traffic on port 2809
- Look for unusual java.exe/beasvc child processes spawning shell commands
Remediation Steps
- 1
Apply Oracle Critical Patch Update
Apply the official Oracle CPU patch addressing CVE-2026-60672 as soon as it is released; track Oracle's security advisory for patch availability.
- 2
Disable or restrict T3/IIOP protocols
Block or restrict network access to T3 and IIOP ports (default 7001/7002 and 2809) at the firewall level, allowing only trusted internal management hosts.
- 3
Network segmentation
Ensure WebLogic servers, especially those integrated with agent orchestration or backend AI services, are isolated from public-facing networks.
- 4
Credential rotation
Rotate any API keys, service account credentials, or secrets accessible from WebLogic-hosted applications in case of prior undetected compromise.
- 5
Enhanced monitoring
Deploy IDS/IPS signatures for known WebLogic T3/IIOP deserialization exploitation patterns and enable verbose logging on WebLogic instances.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.