Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware

CVE-2026-60206 lives in the Core component of Oracle WebLogic Server and is reachable over SAML. Any principal with even the lowest-tier valid credentials on the server can send a crafted request that fully compromises confidentiality, integrity, and availability of the WebLogic instance — and because the CVSS vector shows S:C (scope change), the blast radius extends into the other Fusion Middleware products co-hosted or federated with that WebLogic domain (SOA Suite, OAM, OBIEE, Forms/Reports, Identity Manager). Affected versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 — effectively every currently supported release. Fix landed in the Oracle July 2026 Critical Patch Update, published 2026-07-21.

Oracle's 9.9 CVSS rating is fair and, if anything, understated for enterprises running WebLogic as an identity broker or as the fronting tier for PeopleSoft/EBS. Yes, PR:L gates the attack behind *some* credential — but WebLogic domains typically have dozens of low-privilege service accounts, integration users, and B2B partner logins whose credentials leak from CI logs, config files, and third-party partners weekly. Historically, Core deserialization and SAML-adjacent WebLogic bugs (CVE-2020-2883, CVE-2020-14750, CVE-2020-14882, CVE-2023-21839) go from patch → KEV inside 30 days. Treat this as pre-KEV.

Why this verdict

• Role multiplier — CRITICAL floor holds: WebLogic managed servers are the FMW integration/identity plane. The chain ends in OPSS wallet theft → cross-product credential reuse → Oracle DB compromise. This is canonical high-value-role software; the CRITICAL floor is set by definition.
• PR:L is a soft gate, not a hard one: WebLogic realms routinely hold 20–200 low-privilege service accounts, and B2B federations expose partner-supplied credentials. PR:L reduces the attacker pool from 'anyone on the internet' to 'anyone with a leaked service-account password' — which, empirically, is still a very large pool.
• Scope change is the tell: S:C in CVSS explicitly signals impact beyond the vulnerable component. On a shared FMW host that means adjacent products, OPSS credential stores, and DataSource passwords all fall together.
• Historical prior on WebLogic Core: CVE-2020-14882, CVE-2020-2883, CVE-2023-21839 — all reached KEV and mass exploitation within 60 days of CPU. Diff-based PoCs are near-certain.
• No downgrade evidence: No installed-base data suggests <1% of WebLogic instances expose SAML endpoints; the endpoint is enabled by default on many FMW SSO topologies.

Why not higher?

Already at CRITICAL / 9.6. The only reason it isn't a flat 10.0 is that PR:L genuinely does block opportunistic unauthenticated scanning — attackers must first land a credential, which slows down mass exploitation compared to the 9.8 unauthenticated Core CVEs in the same CPU (CVE-2026-60198/60199/60200/60202/60204).

Why not lower?

Downgrading to HIGH would require evidence that the SAML endpoint is rarely enabled AND that low-priv creds are hard to obtain AND that scope-change impact is theoretical. None of those hold for a canonical FMW deployment. The role multiplier floors this at CRITICAL.

1. Apply the Oracle July 2026 CPU on all WebLogic managed servers — This is the only true fix. Per noisgate remediation SLA for CRITICAL, deploy within 90 days; per noisgate mitigation SLA for CRITICAL, have a compensating control in place within 3 days. Cumulative patch — installing July 2026 CPU also carries forward every earlier fix.
2. Firewall SAML, T3, IIOP, and admin console ports to management CIDRs only — Restrict /saml2/*, T3/T3S (7001/7002), IIOP/IIOPS, and /console to jumphost or SOC-management subnets. Do this within 3 days — this is your CRITICAL mitigation-SLA action. Use weblogic.security.net.ConnectionFilterImpl for in-app enforcement plus perimeter ACLs.
3. Rotate every low-privilege WebLogic realm credential — Because PR:L is the gate, invalidating known-leaked and long-lived service-account passwords immediately shrinks the attacker pool. Prioritize B2B partner logins, CI/CD integration users, and any account whose password appears in boot.properties or Git history. Complete within the 30-day window even though verdict is CRITICAL.
4. Enable WebLogic auditing at INFO or higher and forward to SIEM — Capture SAML2 assertion failures, unusual weblogic.jndi lookups, and management-console access. Alert on repeated SAML validation errors from a single principal — the pre-exploit fingerprint.
5. Block outbound egress from WebLogic hosts to non-approved destinations — Kills the second-stage payload download and C2 for post-exploit tooling (Kinsing, 8220 Gang, webshells). Egress allowlist should be limited to patch/repository mirrors and known integration partners.

Run on the WebLogic managed server host as the oracle (or WebLogic domain owner) user, or via SSH from an audit workstation. Invoke as ./check_cve_2026_60206.sh /u01/app/oracle/middleware where the argument is $MW_HOME. Requires read access to $MW_HOME/inventory/registry.xml and the Opatch binary.

#!/usr/bin/env bash
# noisgate verifier for CVE-2026-60206 (Oracle WebLogic July 2026 CPU)
# Usage: ./check_cve_2026_60206.sh <MW_HOME>
# Exits: 0 PATCHED, 1 VULNERABLE, 2 UNKNOWN

set -u
MW_HOME="${1:-}"
if [[ -z "$MW_HOME" || ! -d "$MW_HOME" ]]; then
  echo "UNKNOWN: MW_HOME not provided or not a directory"; exit 2
fi

OPATCH="$MW_HOME/OPatch/opatch"
if [[ ! -x "$OPATCH" ]]; then
  echo "UNKNOWN: opatch not found at $OPATCH"; exit 2
fi

# Detect installed WebLogic version
WL_JAR=$(find "$MW_HOME" -name 'weblogic.jar' -path '*server/lib/*' 2>/dev/null | head -1)
if [[ -z "$WL_JAR" ]]; then
  echo "UNKNOWN: weblogic.jar not found under $MW_HOME"; exit 2
fi
WL_VER=$(unzip -p "$WL_JAR" META-INF/MANIFEST.MF 2>/dev/null | awk -F': ' '/Implementation-Version/ {print $2; exit}' | tr -d '\r')
echo "Detected WebLogic version: ${WL_VER:-unknown}"

case "$WL_VER" in
  12.2.1.4.0|14.1.1.0.0|14.1.2.0.0|15.1.1.0.0) : ;; 
  *) echo "UNKNOWN: version $WL_VER not in affected list; verify manually"; exit 2 ;;
esac

# List patches and look for July 2026 CPU marker
PATCHES=$("$OPATCH" lspatches 2>/dev/null)
if echo "$PATCHES" | grep -qiE 'JULY 2026|CPUJUL2026|WLS PATCH SET UPDATE.*2026'; then
  echo "PATCHED: July 2026 CPU applied"; exit 0
fi

# Also accept CVE ID appearing in patch metadata
if echo "$PATCHES" | grep -q 'CVE-2026-60206'; then
  echo "PATCHED: CVE-2026-60206 fix present"; exit 0
fi

echo "VULNERABLE: WebLogic $WL_VER without July 2026 CPU applied"
exit 1

Sources

1. SecurityOnline — CVE-2026-60206 writeup
2. CyCognito — Emerging Threat: WebLogic July 2026 CPU
3. SecNews — Oracle WebLogic CPU July 2026 deserialization roundup
4. Threat-Modeling.com — Oracle July 2026 CPU summary
5. byteiota — Oracle CPU July 2026 analysis
6. Intruder cvemon — CVE-2026-60206
7. CISA Known Exploited Vulnerabilities catalog