CVSS 9.8

Oracle Issues Emergency Patches for Critical Remotely Exploitable WebLogic Server Vulnerabilities

Oracle released an emergency security update on August 18 containing 943 new patches across dozens of enterprise product families. The update addresses multiple high-severity flaws in Oracle WebLogic Server that can be exploited remotely without authentication over IIOP, T3, and RMI protocols. Four vulnerabilities—CVE-2026-60698, CVE-2026-60672, CVE-2026-60696, and CVE-2026-60977—received CVSS scores of 9.8 and can impact confidentiality, integrity, and availability of affected servers. A separate critical issue, CVE-2026-61241, was disclosed in the LDAP server component of Oracle Internet Directory with a maximum CVSS score of 10.0 and affects versions 12.2.1.4.0 and 14.1.2.1.0. Oracle urges customers to maintain supported releases and apply patches promptly, noting prior incidents where unpatched systems were targeted after fixes became available. Organizations are advised to validate patches in test environments before production deployment to minimize operational risk.