Oracle WebLogic Server flaw enables server takeover via T3 and IIOP

Threat summary

On August 24, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a maximum-severity Oracle flaw to its Known Exploited Vulnerabilities (KEV) catalog.

This comes as attention also turns to a recently patched Oracle WebLogic Server vulnerability, disclosed last week as part of Oracle's August 2026 Critical Patch Update.

This flaw, CVE-2026-60702, affects the Core component of Oracle WebLogic Server versions:

• 12.2.1.4.0

• 14.1.1.0.0

• 14.1.2.0.0

• 15.1.1.0.0

Oracle assigned it a Common Vulnerability Scoring System (CVSS) v3.1 score of 9.9.

Oracle WebLogic Server is a Java application server and a core component of Oracle Fusion Middleware. It is commonly used to host Oracle applications, identity services, integration platforms, customer-facing applications, and custom business software. WebLogic often supports critical business processes and may provide access to sensitive enterprise data.

A low-privileged threat actor with network access to the WebLogic T3 protocol or Internet Inter-ORB Protocol (IIOP) can exploit the flaw to compromise a vulnerable server. The vulnerability does not require user interaction.

T3 is WebLogic's proprietary communication protocol and is commonly used for communication between WebLogic components. T3 is enabled by default and shares the same listener as the HTTP interface, meaning organizations that expose WebLogic on ports such as 7001 or 7002 may also be exposing T3.

IIOP is used by distributed enterprise applications to exchange information between systems. Oracle provides configuration options for IIOP, making it a separately managed protocol whose availability depends on deployment-specific configuration.

Oracle states that attacks may significantly impact additional products because the vulnerability's scope extends beyond the WebLogic Server itself.

Real-world impact depends on what applications and services rely on the affected server. The worst-case scenario involves takeover of a WebLogic environment supporting business-critical applications.

Analysis

Organizations operating internet-facing WebLogic deployments are likely at the highest risk, particularly where T3 or IIOP services are reachable from untrusted networks. Environments hosting identity services, Oracle business applications, customer portals, middleware platforms, and custom Java applications may be affected because WebLogic frequently acts as the underlying application platform.

Organizations that integrate WebLogic with LDAP or Active Directory may face additional risk because employee accounts can be used to authenticate directly to WebLogic. A threat actor who obtains credentials for a user with WebLogic access may already possess the level of access required to exploit the vulnerability. Environments that use separate WebLogic authentication mechanisms present an additional barrier because the threat actor must first obtain credentials that are valid specifically for WebLogic.

Successful exploitation can result in control of the affected WebLogic Server instance. Depending on the server's role, this may allow access to business applications, application data, middleware services, and connected systems hosted on or dependent upon the platform. In environments where WebLogic supports multiple business applications, the impact may extend beyond the compromised server to other services that rely on it.

WebLogic has historically been a frequent target for threat actors because it is widely deployed in enterprise environments and often hosts high-value applications.

Mitigations

Identifying Oracle WebLogic Server deployments and affected versions can be challenging because WebLogic often operates as a supporting component rather than a standalone application.

Asset reviews may need to include Oracle Fusion Middleware environments, identity services, application server inventories, Java middleware deployments, and custom enterprise applications. Useful sources include Oracle Enterprise Manager, configuration management databases, virtualization and cloud inventories, application deployment documentation, load balancer configurations, and network scans identifying WebLogic listeners on ports such as 7001 or 7002. Internet-facing systems and environments supporting customer-facing applications, identity services, or critical business processes warrant priority review.

Review exposure of T3 and IIOP services and restrict access to trusted networks where possible. Validate that these services are not reachable through load balancers, reverse proxies, or other externally accessible paths.

Because exploitation requires valid credentials, review who can authenticate to WebLogic and remove unnecessary access. Remove inactive accounts, review service and shared accounts, and verify that directory groups grant access only to users who require it.

Apply Oracle's August 2026 security updates to affected WebLogic deployments and monitor for unusual authentication activity, unexpected administrative actions, and anomalous communications involving WebLogic servers that could indicate suspicious activity.

Stay on top of emerging threats like this.

Sign up to receive a weekly roundup of our security intelligence feed. You'll be the first to know of emerging attack vectors, threats, and vulnerabilities. 

Sign up