What is the CVSS score of EUVD-2026-46612?

EUVD-2026-46612 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebLogic Server are affected by EUVD-2026-46612?

Oracle WebLogic Server (versions 12.2.1.4.0 through 15.1.1.0.0) contains a critical CVSS 9.9 vulnerability enabling complete server compromise through the SAML authentication mechanism by a…

Is there a public PoC exploit available for EUVD-2026-46612?

Yes, a public proof-of-concept exploit is available for EUVD-2026-46612. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate EUVD-2026-46612?

Within 24 hours, conduct a complete inventory of all Oracle WebLogic Server deployments to identify affected versions (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0) and assess network exposure, prioritizing systems accessible to low-privileged users or untrusted networks. Within 7 days, implement network segmentation and access controls to restrict SAML authentication endpoints, disable SAML authentication if operational alternatives exist, and deploy enhanced monitoring for exploitation attempts including abnormal authentication patterns and privilege escalation activity. Within 30 days, establish continuous monitoring of Oracle security advisories for patch availability, create a pre-production testing plan for rapid patched-version deployment, and evaluate alternative identity provider configurations to reduce SAML attack surface.

Oracle WebLogic Server EUVD-2026-46612

| CVE-2026-60206 CRITICAL

Improper Authentication (CWE-287)

2026-07-21 oracle

GHSA-crc2-q53j-p7j9

Authentication Bypass Oracle Oracle Weblogic Server Oracle Corporation

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network-reachable SAML flow with low complexity and only low privileges required (PR:L), full server takeover gives C/I/A High, and impact beyond the component's authority justifies S:C.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:00 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

CRITICAL 9.9

DescriptionCVE.org

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SAML to compromise Oracle WebLogic Server. While the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Full server takeover in Oracle WebLogic Server (Fusion Middleware Core component) is achievable by a low-privileged, network-adjacent attacker abusing the SAML authentication path, with a scope change that can propagate impact into additional connected products. Affected supported versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0; the CVSS 9.9 rating reflects complete loss of confidentiality, integrity and availability. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV, but the low complexity and low privilege requirement make it a top-priority patching item.

Technical ContextAI

Oracle WebLogic Server is a widely deployed Java EE application server that sits at the core of many Oracle Fusion Middleware stacks. The flaw resides in the 'Core' component and is reached via SAML - the Security Assertion Markup Language single sign-on / federation flow - implying a weakness in how the server validates or processes SAML assertions or trust relationships. Oracle assigned no CWE, but the class is consistent with improper authentication/authorization handling in SAML processing (e.g., assertion validation or signature-trust weaknesses) that lets an authenticated-but-low-privileged principal escalate to full control. The CVSS scope change (S:C) indicates the vulnerable WebLogic component can affect resources beyond its own security authority, such as downstream integrated Fusion Middleware or backend systems that trust WebLogic.

RemediationAI

Apply the fixes from Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) to every affected release (12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0); Patch available per vendor advisory, though Oracle CPUs distribute patch bundles rather than a single named fix version, so consult the CPU matrix for the exact patch ID matching your installation. Until patched, reduce exposure by restricting network reachability of WebLogic administrative and SAML/SSO endpoints to trusted networks only (e.g., front them behind a VPN or reverse proxy with strict allow-lists), and if SAML single sign-on is not required, disabling or removing the SAML identity-asserter/service-provider configuration removes the attack surface at the cost of breaking federated login. Tighten and monitor low-privilege account provisioning since PR:L exploitation requires a minimal foothold. Note the trade-off: network restrictions may disrupt legitimate remote administration and federated partners, so stage changes carefully.