Oracle's July CPU Dropped Five 9.8 WebLogic RCEs at Once — Patch During the Quiet Window

Every quarter Oracle ships a Critical Patch Update, and every quarter a little part of me braces before opening the advisory — it's a wall of hundreds of fixes across products most of us have never touched, and somewhere in that wall is the one row that ruins your week. For July 2026, that row was actually five rows. Five separate CVSS 9.8 unauthenticated remote code execution flaws in Oracle WebLogic Server, each one a full takeover, all fixed in the same update. So let's filter the firehose and figure out which of these actually matter and what to do before someone writes the exploit.

The five that matter

All five live in WebLogic Server's Core component (CVE-2026-60198/60199/60200/60202/60204). Each is scored identically: 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, no authentication, no user interaction, and a clean sweep of confidentiality, integrity and availability. Here are the live cards:

Same score, three different front doors

What makes this cluster worth splitting apart is the protocol each one rides in on. Same component, same 9.8, but three distinct attack surfaces — and that matters a lot for which network control actually helps you.

Three of the five (60198, 60202, 60204) are reachable over T3 and IIOP — WebLogic's proprietary RMI protocols, historically the most abused corner of the product. One (60199) rides plain HTTP, and one (60200) comes in over SOAP. If your WebLogic is internet-exposed, the HTTP and SOAP variants are the ones you can't hide behind a T3 firewall rule.

Why this bug class never dies

If you've been doing this a while, 'unauthenticated RCE in WebLogic over T3' probably triggers a specific kind of déjà vu. It should. This is one of the most reliably recurring vulnerability patterns in enterprise Java, and the CISA KEV catalog is littered with its previous incarnations. Here are three of the greatest hits — pulled live so you can see how they aged:

Notice the through-line: 2017-10271 (T3, weaponized into a cryptomining worm), 2020-14882 (HTTP console bypass, mass-exploited within days of disclosure), and 2023-21839 (T3/IIOP JNDI). Now look at where their EPSS sits today versus the five newborns:

The 'is it deserialization?' wrinkle — let's be honest

You'll see coverage describing the T3/IIOP entries as Java deserialization flaws, and given the history that's a very reasonable read. But I want to keep the labels clean, because they're easy to conflate. On cve.tools and NVD, all five are currently tagged CWE-306 (Missing Authentication for a Critical Function) — not CWE-502 (Deserialization of Untrusted Data). Oracle's advisory, as is its custom, describes what an attacker achieves (unauthenticated takeover) rather than the underlying gadget.

Am I affected?

One nuance worth flagging: this is not a continuous 'everything from 12.2.1.4 to 15.1.1' range, even though it's easy to read it that way. The affected product data lists four specific supported release lines. If you're on one of them, patch; if you're on an older unsupported line, you're off Oracle's fix path entirely and should be planning an upgrade regardless.

What to do now

This is a pre-exploit story, which means you get to do the calm version of incident response instead of the 3 a.m. version. Here's the order I'd work it:

1. Inventory: identify every WebLogic instance on 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 or 15.1.1.0.0. WebLogic loves to hide inside Fusion Middleware, EBS, and appliance stacks you forgot were running it.
2. Apply the July 2026 Critical Patch Update. That's the only actual fix — treat it as the deliverable, not the network controls below.
3. For anything internet-exposed you cannot patch this week: get T3/IIOP off the public internet. WebLogic's built-in connection filter (weblogic.security.net.ConnectionFilterImpl) can deny t3/t3s/iiop from untrusted networks — but this does nothing for the HTTP (60199) and SOAP (60200) variants, so it is not a substitute for patching.
4. After patching, confirm the running build actually rolled over — a staged patch that never got a restart is a classic false sense of safety.
5. Watch for a public PoC. The moment one lands, the EPSS on these jumps and you've left the quiet window.

Timeline

CVE data current as of 2026-07-31live record →