Oracle Weblogic Server — CVE-2026-60977 (Critical)

Date Aug 18, 2026

Type Vendor advisory

Signal Critical vendor advisory

Vendor / Product Oracle · Weblogic Server

CVE CVE-2026-60977

Critical vendor advisory CVE-2026-60977

Summary

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via RMI to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Why it matters

This CVE carries a CRITICAL severity rating (CVSS 9.8) in Oracle Weblogic Server. Patch or mitigate promptly. EPSS percentile: 42%.

Operator check

Review CVE-2026-60977 in your asset inventory. Apply patches per vendor guidance and verify Weblogic Server is not exposed. CVSS score: 9.8. EPSS probability: 0.5%; percentile: 42%.

Sources

NVD — CVE-2026-60977 Source reference

PatchBrief uses public sources. It does not scan environments, verify exposure, or replace vendor guidance.

Get watched-vendor alerts Subscribe free Back to feed