What is the CVSS score of EUVD-2026-46890?

EUVD-2026-46890 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle WebLogic Server are affected by EUVD-2026-46890?

Oracle WebLogic Server versions 14.1.2.0.0 and 15.1.1.0.0 contain a privilege abuse vulnerability in the Console component that enables high-privileged attackers to corrupt, delete, and exfiltrate…

How to fix or mitigate EUVD-2026-46890?

Within 24 hours, identify all Oracle WebLogic Server instances running versions 14.1.2.0.0 or 15.1.1.0.0 and audit privileged account access, particularly administrative Console users and service accounts with high privileges. Within 7 days, conduct a comprehensive risk assessment of each instance, including connected downstream systems, and implement enhanced monitoring of Console activity and suspicious data operations. Within 30 days, develop a remediation timeline-either through upgrade to a patched version when released or through implementation of network-level compensating controls to restrict high-privileged access to the Console component.

Oracle WebLogic Server EUVD-2026-46890

| CVE-2026-60528 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-ch59-3g4r-2xv7

Authentication Bypass Oracle Weblogic Server

7.6

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.6 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:N

vuln.today AI

7.6 HIGH

Network HTTP access with low complexity but requiring high Console privileges gives PR:H; high integrity and low confidentiality impact, no availability impact, with a scope change to other products.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:53 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 7.6

DescriptionCVE.org

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. While the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebLogic Server accessible data as well as unauthorized read access to a subset of Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:N).

AnalysisAI

Privilege abuse in the Console component of Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 lets a high-privileged, network-based attacker corrupt or delete critical data and read a subset of data, with a scope change that can impact other products beyond WebLogic itself. Oracle rates it CVSS 3.1 7.6 and, despite the 'Authentication Bypass' tag applied by the reporter, the CVSS vector requires PR:H (high existing privileges). No public exploit identified at time of analysis and it is not listed in CISA KEV; disclosed in the Oracle Critical Patch Update of July 2026.

Technical ContextAI

The flaw resides in the administrative Console of Oracle WebLogic Server, a Java EE application server widely used to host enterprise middleware and business applications. Exploitation occurs over HTTP against the management console interface. The reporter tags this as an Authentication Bypass, but Oracle's own CVSS vector (PR:H) indicates the attacker must already hold high privileges, so the practical effect is privilege abuse or escalation of impact from an administrative context rather than a pre-auth bypass. No CWE was assigned by NVD/Oracle, so the precise root-cause class (e.g., access-control or deserialization weakness common to WebLogic Console issues) cannot be confirmed from the provided data. The Scope:Changed metric reflects Oracle's note that a successful attack can significantly affect additional products beyond WebLogic Server.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026; the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html is the authoritative source for the exact patch/bundle to apply for WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 (Patch available per vendor advisory - an exact fixed build number is not provided in the input and should be taken directly from the CPU matrix). Because exploitation requires high privileges via the administrative Console over HTTP, effective compensating controls until patching include restricting network access to the WebLogic Administration Console to trusted management networks or a bastion/jump host (side effect: administrators must route through the controlled path), placing the Console behind a VPN or IP allowlist, and tightly limiting and auditing the set of accounts holding administrative WebLogic roles. Review and rotate credentials for privileged Console accounts and enable monitoring/alerting on administrative data-modification actions, since the primary risk is abuse by or through an already-privileged account.