CVE-2026-60206
A critical flaw in Oracle WebLogic Server allows attackers with low privileges to take full control of the server over the network. The vulnerability is easy to exploit via SAML authentication and can compromise confidentiality, integrity, and availability. It affects several recent WebLogic Server releases.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 – typically used by enterprise application administrators.
Real-world impact
An attacker who can reach the server over the network can gain low‑privilege access and then elevate to full control, allowing them to read, modify, or delete data, disrupt services, and potentially compromise other connected systems.
Why this severity
The CVSS score of 9.9 reflects that the flaw can be exploited from the network with minimal effort and low privilege, and it grants complete compromise of confidentiality, integrity, and availability. The high score indicates a severe risk to any organization running the affected WebLogic Server versions.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jul 21, 2026 · 11d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 28, 2026 · 4d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- oracle.com/security-alerts/cpujul2026.…vendor advisory