Skip to main content

Oracle WebLogic Server EUVDEUVD-2026-46889

| CVE-2026-60527 HIGH
Improper Access Control (CWE-284)
2026-07-21 secalert_us@oracle.com GHSA-c9jp-cw45-rgmv
Oracle Authentication Bypass Weblogic Server
7.1
CVSS 3.1 · Vendor: oracle
Share

Severity by source

Vendor (oracle) PRIMARY
7.1 HIGH
AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
vuln.today AI
7.1 HIGH

Requires local logon to the host but no WebLogic credentials (AV:L, PR:N); scope change plus high confidentiality-only impact (S:C, C:H, I:N, A:N) matches an auth-bypass data-exposure flaw.

3.1 AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

2
Analysis Generated
Jul 22, 2026 - 09:09 vuln.today
CVE Published
Jul 21, 2026 - 22:17 nvd
HIGH 7.1

DescriptionCVE.org

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle WebLogic Server executes to compromise Oracle WebLogic Server. While the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).

AnalysisAI

Unauthorized data access in Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 (Console component) allows an attacker with local logon to the hosting infrastructure to compromise the server and read all WebLogic-accessible data, with a scope change that can significantly impact other collocated products. Oracle rates it CVSS 3.1 7.1 (confidentiality-only). …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Obtain local logon on WebLogic host
Delivery
Reach administration Console
Exploit
Bypass Console authentication
Execution
Read all WebLogic-accessible data
Impact
Pivot to collocated products via scope change
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the attacker already possess a logon to the infrastructure/host where Oracle WebLogic Server executes (CVSS AV:L), but does NOT require valid WebLogic application credentials (PR:N) or any user interaction (UI:N), and attack complexity is low (AC:L). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The signals point to a serious-but-locally-gated issue rather than an internet-facing critical. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who has obtained a low-privilege interactive logon on a server hosting Oracle WebLogic (for example a shared jump host, a compromised co-located application account, or an insider) reaches the local WebLogic Console and abuses the authentication-bypass weakness to gain unauthorized read access to all data the server can reach. Because the vulnerability carries a scope change, the exposed data may include secrets or resources belonging to other products deployed alongside WebLogic. …
Remediation Apply the fixes in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) to the affected WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 installations - Patch available per vendor advisory (Oracle CPU July 2026); an exact patched build string was not included in the input, so consult the CPU patch matrix for the precise interim/PSU number for your version. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all systems running Oracle WebLogic Server versions 14.1.2.0.0 or 15.1.1.0.0. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Weblogic Server

View all
CVE-2019-2725 CRITICAL POC
9.8 Apr 26

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Rated cr
CVE-2017-10271 HIGH POC
7.5 Oct 19

Oracle WebLogic Server allows unauthenticated remote code execution through the WLS Security component's T3 protocol, ma
CVE-2016-3510 CRITICAL POC
9.8 Jul 21

Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12
CVE-2017-3248 CRITICAL POC
9.8 Jan 27

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Core Components). Rated
CVE-2017-5645 CRITICAL POC
9.8 Apr 17

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events
CVE-2016-0638 CRITICAL
9.8 Apr 21

Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, an
CVE-2021-4104 HIGH
7.5 Dec 14

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Lo
CVE-2016-8610 HIGH
7.5 Nov 13

A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
CVE-2020-11113 HIGH
8.8 Mar 31

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
CVE-2022-22965 CRITICAL POC
9.8 Apr 01

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data b
CVE-2020-14750 CRITICAL POC
9.8 Nov 02

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Rated critical sev
CVE-2020-14882 CRITICAL POC
9.8 Oct 21

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Rated critical sev

Same weakness CWE-284 – Improper Access Control

View all
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2012-5076 CRITICAL POC
9.8
CVE-2014-3120 HIGH POC
8.1
CVE-2013-2423 LOW POC
3.7
CVE-2016-3427 CRITICAL
9.8
CVE-2025-12480 CRITICAL POC
9.1

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

EUVD-2026-46889 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy