Skip to main content

Oracle WebLogic Server CVE-2026-60528

| EUVDEUVD-2026-46890 HIGH
Improper Access Control (CWE-284)
2026-07-21 secalert_us@oracle.com GHSA-ch59-3g4r-2xv7
Oracle Authentication Bypass Weblogic Server
7.6
CVSS 3.1 · Vendor: oracle
Share

Severity by source

Vendor (oracle) PRIMARY
7.6 HIGH
AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:N
vuln.today AI
7.6 HIGH

Network HTTP access with low complexity but requiring high Console privileges gives PR:H; high integrity and low confidentiality impact, no availability impact, with a scope change to other products.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:N
4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Changed
Confidentiality
Low
Integrity
High
Availability
None

Lifecycle Timeline

2
Analysis Generated
Jul 22, 2026 - 07:53 vuln.today
CVE Published
Jul 21, 2026 - 22:17 nvd
HIGH 7.6

DescriptionCVE.org

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. While the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebLogic Server accessible data as well as unauthorized read access to a subset of Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:N).

AnalysisAI

Privilege abuse in the Console component of Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 lets a high-privileged, network-based attacker corrupt or delete critical data and read a subset of data, with a scope change that can impact other products beyond WebLogic itself. Oracle rates it CVSS 3.1 7.6 and, despite the 'Authentication Bypass' tag applied by the reporter, the CVSS vector requires PR:H (high existing privileges). …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain high-privileged Console access
Delivery
Reach WebLogic Console over HTTP
Exploit
Send crafted Console request
Execution
Modify or delete critical data
Impact
Impact extends to additional products (scope change)
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the attacker to already hold high WebLogic privileges (CVSS PR:H) and network HTTP access to the Oracle WebLogic Server Console component on version 14.1.2.0.0 or 15.1.1.0.0; no user interaction is needed (UI:N) and attack complexity is low (AC:L). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 base score is 7.6 (High) with vector AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:N - network reachable, low complexity, no user interaction, but requiring high privileges. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who has obtained high-privileged WebLogic Console credentials (for example, via credential theft, a compromised administrator workstation, or a malicious insider) sends crafted HTTP requests to the Console component. Leveraging the flaw, they modify or delete critical WebLogic-accessible data and read a subset of protected data, with impact potentially spilling over into additional products due to the scope change. …
Remediation Apply the fixes delivered in the Oracle Critical Patch Update of July 2026; the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html is the authoritative source for the exact patch/bundle to apply for WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 (Patch available per vendor advisory - an exact fixed build number is not provided in the input and should be taken directly from the CPU matrix). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all Oracle WebLogic Server instances running versions 14.1.2.0.0 or 15.1.1.0.0 and audit privileged account access, particularly administrative Console users and service accounts with high privileges. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Weblogic Server

View all
CVE-2019-2725 CRITICAL POC
9.8 Apr 26

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Rated cr
CVE-2017-10271 HIGH POC
7.5 Oct 19

Oracle WebLogic Server allows unauthenticated remote code execution through the WLS Security component's T3 protocol, ma
CVE-2016-3510 CRITICAL POC
9.8 Jul 21

Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12
CVE-2017-3248 CRITICAL POC
9.8 Jan 27

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Core Components). Rated
CVE-2017-5645 CRITICAL POC
9.8 Apr 17

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events
CVE-2016-0638 CRITICAL
9.8 Apr 21

Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, an
CVE-2021-4104 HIGH
7.5 Dec 14

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Lo
CVE-2016-8610 HIGH
7.5 Nov 13

A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
CVE-2020-11113 HIGH
8.8 Mar 31

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
CVE-2022-22965 CRITICAL POC
9.8 Apr 01

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
CVE-2020-14750 CRITICAL POC
9.8 Nov 02

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Rated critical sev
CVE-2020-14882 CRITICAL POC
9.8 Oct 21

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Rated critical sev

Same weakness CWE-284 – Improper Access Control

View all
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2012-5076 CRITICAL POC
9.8
CVE-2014-3120 HIGH POC
8.1
CVE-2013-2423 LOW POC
3.7
CVE-2016-3427 CRITICAL
9.8
CVE-2025-12480 CRITICAL POC
9.1

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-60528 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy