CVE-2026-60365 in Weblogic Server Proxy Plug-in
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers). The supported version that is affected is 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Weblogic Server Proxy Plug-in. While the vulnerability is in Oracle Weblogic Server Proxy Plug-in, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Weblogic Server Proxy Plug-in accessible data as well as unauthorized access to critical data or complete access to all Oracle Weblogic Server Proxy Plug-in accessible data. CVSS 3.1 Base Score 10.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/24/2026
This vulnerability resides within the Oracle WebLogic Server Proxy Plug-in component of Oracle Fusion Middleware, specifically affecting version 15.1.1.0.0. The flaw represents a critical security weakness that can be exploited by unauthenticated attackers who have network access through HTTP protocols. The CVSS 3.1 base score of 10.0 indicates the highest severity level, reflecting both confidentiality and integrity impacts that are rated as high. This vulnerability falls under CWE-284 which addresses improper access control issues, specifically targeting weak authentication mechanisms in web server proxy configurations.
The technical nature of this flaw allows attackers to bypass authentication requirements entirely, enabling them to perform unauthorized operations against the affected WebLogic Server Proxy Plug-in. The vulnerability's impact extends beyond the immediate component, as evidenced by the scope change that affects additional products within the Oracle Fusion Middleware ecosystem. Attackers can leverage this weakness to create, delete, or modify critical data within the proxy plug-in's accessible data stores. The complete access capabilities mean that adversaries could potentially gain full read and write privileges to all data managed by the affected proxy component.
Operationally, this vulnerability poses significant risks to enterprise security infrastructure as it allows attackers to compromise the core web server proxy functionality without requiring valid credentials. The network-based attack vector means that even systems behind firewalls could be vulnerable if they expose HTTP services to untrusted networks. The impact on data integrity and confidentiality is particularly concerning since attackers could modify critical system configurations or steal sensitive information from the proxy plug-in's data repositories.
Organizations should implement immediate mitigations including network segmentation to restrict access to WebLogic Server Proxy Plug-in interfaces, deployment of web application firewalls to monitor and filter HTTP traffic, and implementation of strict access controls. The use of secure configuration practices for Oracle Fusion Middleware components, along with regular patch management processes, becomes critical in preventing exploitation. Additionally, monitoring for unusual HTTP traffic patterns and implementing intrusion detection systems can help identify potential exploitation attempts. Given the scope change implications, organizations must also evaluate their broader Oracle Fusion Middleware environment to ensure other related components are not similarly affected by this class of vulnerability.