CVE-2026-60206

Severity: critical (CVSS 9.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-21 · updated 2026-10-24
Weakness: CWE-306

Description

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SAML to compromise Oracle WebLogic Server. While the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

Summary

CVE-2026-60206 is a critical (CVSS 9.9) flaw in the Core component of Oracle WebLogic Server that lets a low-privileged attacker with network access via SAML compromise the server, potentially leading to full takeover and scope change affecting other products. Affected supported versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. It is not in CISA KEV and SSVC reports no known exploitation, with EPSS estimating a 0.4% chance of exploitation in 30 days. Apply the Oracle patch for your affected version and restrict SAML/network exposure where possible.

CVE-2026-60206 ثغرة حرجة (CVSS 9.9) في مكوّن Core من Oracle WebLogic Server تتيح لمهاجم منخفض الصلاحيات لديه وصول شبكي عبر SAML اختراق الخادم، مما قد يؤدي إلى الاستيلاء الكامل عليه وتأثير يمتد إلى منتجات أخرى (scope change). الإصدارات المدعومة المتأثرة هي 12.2.1.4.0 و14.1.1.0.0 و14.1.2.0.0 و15.1.1.0.0. الثغرة ليست في CISA KEV ولا يشير SSVC إلى استغلال معروف، وتقدّر EPSS احتمال الاستغلال خلال 30 يوماً بنسبة 0.4%. طبّق تحديث Oracle الخاص بإصدارك وقلّل من تعرّض SAML والشبكة قدر الإمكان.

Affected products

Oracle WebLogic Server: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 15.1.1.0.0

References

https://www.oracle.com/security-alerts/cpujul2026.html

Get alerted when CVE-2026-60206 or the next vulnerability affects your stack