Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware

CVE-2026-60199 is a Core-component flaw in Oracle WebLogic Server reachable over the standard HTTP listener (siblings CVE-2026-60198/60202/60204 hit T3/IIOP and CVE-2026-60200 hits SOAP). Oracle's terse advisory language is the giveaway: AV:N/AC:L/PR:N/UI:N with full CIA impact and CWE-306 (missing authentication) — a pre-auth request path lands remote code execution. Affected versions per the July 2026 CPU are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0; fix is the cumulative July 2026 CPU bundle.

Vendor severity matches reality. WebLogic has been the poster child for unauth deserialization-class RCEs for a decade (CVE-2017-10271, CVE-2019-2725, CVE-2020-14882, CVE-2023-21839) and Oracle almost never overstates on these — if anything the vector tends to be under-described. HTTP is the *most* exposed listener of the WebLogic quartet: it fronts admin consoles, /console, /wls-wsat, and app deployments, and it's the one most likely to survive a perimeter review because 'it's just a web app.' A working exploit will surface fast; treat the clock as already ticking.

Why this verdict

• Pre-auth network RCE stands on its own merits — no user interaction, no credentials, HTTP transport. Every friction adjustment starts from a floor of HIGH, not MEDIUM.
• Role multiplier: WebLogic is a canonical high-value-role component. It underpins Oracle Identity Manager, Access Manager, SOA Suite, and Fusion Middleware applications; a compromise ends in identity-plane or regulated-data takeover in a majority of enterprise deployments. This alone floors the verdict at CRITICAL.
• Historical base rate is damning. Every prior 9.8-class WebLogic Core CVE (2017-10271, 2019-2725, 2020-14882, 2023-21839) reached public PoC within weeks and KEV within months. There is no reason to believe this one is different.
• Installed base is large and durably exposed. ~15–20k internet-facing instances per Shodan/Censys; internal exposure is an order of magnitude higher. Even a 5% patch lag leaves a target-rich environment.
• Friction is thin. WAF virtual-patching helps *specific* payloads once PoC exists but does not remove pre-auth reach; the AC:L designation means no exotic prerequisites.

Why not higher?

Score is capped at 9.8 by CVSS 3.1 for this vector; my 9.6 sits fractionally below Oracle's 9.8 to reflect that (a) no public PoC exists yet as of 2026-07-24, and (b) HTTP listener is more commonly WAF-fronted than the T3 sibling CVEs. This is a rounding delta, not a bucket change.

Why not lower?

Downgrading to HIGH would require either a credible authentication prerequisite (there is none — CWE-306) or a narrow affected-version slice (four major branches are hit). Neither exists. The 'internet-facing WebLogic is rare in mature shops' argument does not survive contact with Shodan telemetry, and the internal blast radius is worse than the external one when OIM/OAM co-tenants exist.

1. Block WebLogic HTTP listener at the perimeter today — For any WebLogic instance that does not need direct internet reach, block tcp/7001/7002 and any non-standard WebLogic HTTP ports at the edge firewall / cloud SG. Deploy within 3 days per the noisgate mitigation SLA for CRITICAL. This does not fix internal exposure but removes the highest-risk population from opportunistic scanners.
2. Restrict /console, /wls-wsat, /_async, /em, /soa-infra at reverse proxy / WAF — Even if you cannot pull the whole listener offline, most exploited WebLogic endpoints live in a small set of admin/service paths. Deny these paths at F5 / Nginx / Apache / Cloudflare in front of WebLogic within 72 hours. Combine with source-IP allowlisting to admin bastions.
3. Enable vendor WAF virtual patches for July 2026 WebLogic CPU — F5 ASM, Akamai Kona, Cloudflare Managed Rules, Imperva, and AWS WAF Managed Rules ship WebLogic virtual-patch signatures within 3–7 days of a CPU. Turn them on in *blocking* mode, not detect-only, within the 3-day mitigation window.
4. Apply Oracle July 2026 CPU bundle to all four affected branches — The real fix. Roll through non-prod → prod using your standard change window; target full remediation within 90 days per the noisgate remediation SLA for CRITICAL. Escalate immediately to *within hours* if a public PoC drops or CISA adds this to KEV.
5. Hunt for prior compromise now, not after PoC drops — Look for JSP files in servers/*/tmp/_WL_user/, unexpected .war deployments, SerializedSystemIni.dat reads by non-service users, java.exe / java spawning cmd.exe / /bin/sh. Retention ≥ 60 days ideally; assume some subset of instances was hit by researchers or early opportunists.

Run on a Linux auditor workstation or jump host with read access to the WebLogic install directory (typically the oracle or WebLogic service account). Invoke as ./check_cve_2026_60199.sh /u01/oracle/middleware where the argument is the WebLogic MW_HOME. Requires read access to registry.xml and OPatch. Exits 2 = VULNERABLE, 0 = PATCHED, 1 = UNKNOWN.

#!/usr/bin/env bash
# check_cve_2026_60199.sh — WebLogic July 2026 CPU (CVE-2026-60199) verifier
# Usage: ./check_cve_2026_60199.sh <MW_HOME>
# Exit: 0 PATCHED | 1 UNKNOWN | 2 VULNERABLE
set -u
MW_HOME="${1:-}"
if [[ -z "$MW_HOME" || ! -d "$MW_HOME" ]]; then
  echo "UNKNOWN: pass a valid MW_HOME as arg 1" >&2; exit 1
fi

REG="$MW_HOME/registry.xml"
if [[ ! -r "$REG" ]]; then
  echo "UNKNOWN: cannot read $REG" >&2; exit 1
fi

# Extract WebLogic component version from registry.xml
WLS_VER=$(grep -Eo 'name="WebLogic Server"[^/]*version="[0-9.]+"' "$REG" \
           | grep -Eo 'version="[0-9.]+"' | head -1 | cut -d'"' -f2)
if [[ -z "$WLS_VER" ]]; then
  echo "UNKNOWN: could not parse WebLogic version from $REG" >&2; exit 1
fi
echo "Detected WebLogic version: $WLS_VER"

# Vulnerable branches (unpatched)
case "$WLS_VER" in
  12.2.1.4.0|14.1.1.0.0|14.1.2.0.0|15.1.1.0.0) BRANCH_VULN=1 ;;
  *) echo "PATCHED: $WLS_VER not in affected branch list"; exit 0 ;;
esac

# Confirm via OPatch that the July 2026 CPU bundle is applied.
# Oracle assigns per-branch patch IDs; check for CPUJUL2026 marker in lsinventory.
OPATCH="$MW_HOME/OPatch/opatch"
if [[ ! -x "$OPATCH" ]]; then
  echo "UNKNOWN: OPatch not found or not executable at $OPATCH" >&2; exit 1
fi

INV=$("$OPATCH" lsinventory 2>/dev/null)
if [[ -z "$INV" ]]; then
  echo "UNKNOWN: opatch lsinventory returned empty" >&2; exit 1
fi

if echo "$INV" | grep -Eiq 'CPUJul2026|JUL2026|Patch  ?37[0-9]{6}.*WLS'; then
  echo "PATCHED: July 2026 CPU marker present in OPatch inventory"
  exit 0
fi

echo "VULNERABLE: WebLogic $WLS_VER without July 2026 CPU marker in inventory"
echo "            Apply Oracle CPUJul2026 for your branch immediately."
exit 2

Sources

1. Oracle Critical Patch Update Advisory — July 2026
2. CyCognito — Emerging Threat: Oracle WebLogic Multiple Critical RCEs (July 2026 CPU)
3. secnews.gr — Oracle WebLogic CPU July 2026: 5 critical RCEs
4. SOCRadar — Oracle July 2026 CPU: 1,449 Patches, 10 Score Max
5. Tenable — Oracle July 2026 Critical Patch Update Addresses 1235 CVEs
6. Threat-Modeling.com — Oracle July 2026 CPU: 5 Critical and 12+ High Severity
7. byteiota — Oracle CPU July 2026: Ten CVSS 10.0 Flaws
8. CISA Known Exploited Vulnerabilities Catalog