What is the CVSS score of EUVD-2026-46891?

EUVD-2026-46891 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle WebLogic Server are affected by EUVD-2026-46891?

A critical vulnerability in Oracle WebLogic Server 14.1.2 and 15.1.1 administration consoles (CVE-2026-60529) enables high-privileged actors to achieve complete server compromise, potentially…

How to fix or mitigate EUVD-2026-46891?

Within 24 hours, identify all Oracle WebLogic Server instances running versions 14.1.2.0.0 or 15.1.1.0.0 and immediately restrict network access to the administration console to only trusted administrative systems, implementing firewall rules and network segmentation as needed; enable detailed logging of all administration console authentication attempts. Within 7 days, review administration console authentication logs for suspicious or unauthorized high-privileged access attempts, audit the storage and distribution of administrative credentials, and document all systems and users with console access. Within 30 days, establish a process to monitor Oracle's Critical Patch Update bulletins for an available fix and prepare a change management plan to deploy it immediately upon release; simultaneously evaluate whether upgrading to a newer supported WebLogic version is feasible as an alternative mitigation.

Oracle WebLogic Server EUVD-2026-46891

| CVE-2026-60529 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-xvqh-pg75-hr4f

Authentication Bypass Oracle Weblogic Server

7.2

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Console is network-reachable over HTTP (AV:N/AC:L) but exploitation demands high-privilege admin access (PR:H); no user interaction, and full server takeover yields C:H/I:H/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:52 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 7.2

DescriptionCVE.org

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full server takeover of Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 is possible via the administration Console component, where a high-privileged attacker with HTTP network access can fully compromise confidentiality, integrity, and availability. Rated CVSS 3.1 7.2, this is part of Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle WebLogic Server is a Java EE/Jakarta EE application server that forms the core of Oracle Fusion Middleware, hosting enterprise Java applications and exposing a web-based administration Console for domain and server management. The flaw resides in that Console component, which is the privileged administrative interface reachable over HTTP/HTTPS. Oracle's vendor tags label this as Information Disclosure, but the assigned CVSS impacts (C:H/I:H/A:H) and the stated 'takeover' outcome indicate full compromise well beyond disclosure. No CWE was assigned in the source data, so the precise root-cause weakness class (e.g. deserialization, injection, or access-control bypass in the Console) cannot be confirmed from the available intelligence.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) to Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 - this is Patch available per vendor advisory; the input does not specify an exact discrete fix build, so identify the precise patch number for your version from the Oracle CPU matrix rather than inventing one. As compensating controls until patching, restrict network access to the administration Console by binding it to a dedicated internal admin network/channel and blocking the Console context path (typically /console) at the perimeter and load balancer so it is not reachable from general application traffic; the trade-off is that remote administrators must connect via VPN/bastion. Additionally, tighten which accounts hold high-privilege WebLogic roles (Admin/Deployer/Operator), since exploitation requires PR:H - reducing the population of privileged Console users directly shrinks the attack surface, at the cost of operational overhead for delegated administration.