EUVD-2026-46778
GHSA-2q8m-vp67-qw33
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed proxy plug-in over HTTP
-
ExploitCraft request bypassing authentication
-
ExecutionForward as trusted to WebLogic back-end
-
ImpactCreate, modify or delete critical data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only network HTTP access to a deployment running the WebLogic Server Proxy Plug-in (or Oracle HTTP Server embedding it) at version 12.2.1.4.0 or 14.1.2.0.0 as a front-end to WebLogic Server; per the vendor vector (AV:N/AC:L/PR:N/UI:N) there is no authentication, no user interaction, and no special configuration prerequisite beyond having the proxy plug-in deployed and reachable. Limiting factors: the vulnerable plug-in must actually be in use and network-accessible to the attacker - deployments that do not use the third-party-web-server proxy plug-in, or that isolate it behind authenticated gateways or trusted-network-only access, are not exposed. Impact is bounded to integrity (data tampering); confidentiality and availability are not affected per Oracle's scoping. |
| Impact | The CVSS vector provided by Oracle (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N = 7.5) indicates easy, unauthenticated, network-based exploitation with high integrity impact but NO confidentiality or availability impact. This conflicts with the separately supplied aggregate 'CVSS Score: 9.8' and its C:H/I:H/A:H vector - that fuller-impact vector is not supported by Oracle's own description, which explicitly scopes impact to integrity only; the 9.8 appears to be an over-broad aggregator value and should be treated with caution, with Oracle's 7.5 integrity-only assessment as authoritative. No EPSS score, KEV entry, or POC was provided, so real-world exploitation pressure is currently unquantified. Net: this is a genuine unauthenticated network-facing integrity flaw in an internet-exposed proxy tier and should be patched promptly, but the headline 9.8 overstates the impact - the confirmed risk is data tampering, not full compromise or denial of service. |
| Exploit ScenarioDerived | An attacker who can reach the proxy plug-in over HTTP sends specially crafted requests that the plug-in mishandles, bypassing expected authentication and forwarding them to the WebLogic back-end as trusted traffic. This lets the attacker create, alter, or delete critical application data without any credentials or user interaction. No public POC was identified at time of analysis, but the low attack complexity makes weaponization straightforward if internal details become known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Unauthorized data modification in Oracle WebLogic Server Proxy Plug-in (the proxy module for third-party web servers such as Apache/Oracle HTTP Server) lets a remote, unauthenticated attacker tamper with critical data over HTTP. Oracle's authoritative scoring rates this CVSS 3.1 7.5 with integrity-only impact (I:H, C:N, A:N), disclosed in the July 2026 Critical Patch Update and tagged as an authentication-bypass class issue. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
RemediationAI
Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) to all affected 12.2.1.4.0 and 14.1.2.0.0 deployments of the WebLogic Server Proxy Plug-in and Oracle HTTP Server; the input provides the CPU advisory but not a discrete patched build string, so treat 'Patch available per vendor advisory' as the status and pull the exact patch/OPatch bundle for your platform from the CPU. Until patching, reduce exposure by restricting network reach to the proxy tier - front the plug-in with a WAF or reverse proxy that enforces authentication and filters anomalous proxied requests, and limit inbound HTTP to the plug-in to trusted networks; note this can break legitimate external access if the WebLogic app is meant to be public, so scope allow-lists carefully. Because the flaw is unauthenticated and network-reachable, avoid exposing the proxy directly to the internet where the back-end WebLogic application does not require it.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the WebLogic Server Proxy Plug-in, a native module that runs inside third-party or Oracle HTTP Server front-ends (Apache, OHS) to reverse-proxy requests to a WebLogic Server back-end cluster. Because it terminates and forwards HTTP on behalf of WebLogic, flaws here sit directly in the request-handling path before application authentication is fully enforced, which is consistent with the vendor 'Authentication Bypass' tag. No CWE was assigned in the input, but the described effect - unauthorized creation, deletion or modification of data by an unauthenticated network client - points to a request routing/authorization-handling weakness in the plug-in rather than a memory-safety bug. Affected code ships in Oracle Fusion Middleware releases 12.2.1.4.0 and 14.1.2.0.0.
Know when Http Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated remote HTTP access with low complexity (AV:N/AC:L/PR:N/UI:N); Oracle scopes impact to integrity only, so C:N/I:H/A:N, matching the 7.5 base.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Weblogic Server Proxy Plug-in. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Weblogic Server Proxy Plug-in accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
Executive ViewAI
Oracle WebLogic Server Proxy Plug-in (CVE-2026-60364) permits unauthenticated remote attackers to modify critical application data over HTTP, directly compromising the integrity of systems that organizations depend on for business operations. Any organization using Apache HTTP Server or Oracle HTTP Server with WebLogic proxy integration faces immediate risk to data consistency and application reliability. With CRITICAL severity (CVSS 9.8) and no vendor-released patch identified at time of analysis, this represents a severe attack surface requiring urgent remediation.
Enforce network segmentation to limit HTTP access to the proxy component to internal, trusted networks only; implement mandatory use of HTTPS/TLS for all proxy communications where feasible; deploy Web Application Firewall (WAF) rules configured to detect and block abnormal data modification patterns; enable and actively monitor detailed proxy access logs and request payloads for intrusion detection; consider disabling the proxy plug-in entirely if functionally redundant or replaceable by alternative solutions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Http Server
View allA crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.4.4
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user
The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for
Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denia
The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2
Oracle HTTP Server and WebLogic Server Proxy Plug-in have a CVSS 10.0 access control vulnerability allowing unauthentica
Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due
The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directiv
mod_session_dbd.c in the mod_session_dbd module in the Apache HTTP Server before 2.4.5 proceeds with save operations for
The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from t
The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which al
Exploit-DB