CVE-2026-60364
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
Vulnerability in Oracle WebLogic Server Proxy Plug-in (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers). Unauthenticated attacker via network (HTTP) can modify data.
Risk Assessment
Risk of unauthorized modification of critical data, potentially compromising system integrity.
Recommendation
Apply patches provided by Oracle for versions 12.2.1.4.0 and 14.1.2.0.0.
Other vulnerabilities in Oracle WebLogic Server
See all- CVE-2026-101515Medium
Vulnerability in Oracle WebLogic Server (component: Centralized Thirdparty Jars) affects versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. A difficult to exploit flaw allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical data or complete access to all server data.
- CVE-2017-10147High
A vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware allows an unauthenticated attacker with network access via T3 to compromise the server. Attacks may lead to hanging or frequent crashes of the server, resulting in a complete denial of service (DoS).
- CVE-2016-3505High
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12.2.1.0 allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to JavaServer Faces.
- CVE-2016-0577High
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and availability.
- CVE-2016-0574High
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and availability.
- CVE-2016-0573High
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS Java Messaging Service.
- CVE-2016-0572High
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Coherence Container.
- CVE-2014-2470High
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2.0, 10.3.6.0, 12.1.1.0, and 12.1.2.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS Security.
- CVE-2026-91323Critical
Vulnerability in Oracle WebLogic Server (Core component) affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. An unauthenticated attacker with HTTP network access can take over the server.
- CVE-2026-87302Critical
Vulnerability in Oracle WebLogic Server (Core component) affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. An unauthenticated attacker with network access via HTTP can create, delete, or modify critical data and gain full access to it.
Original NVD description (English source)
Vulnerability in the Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: WebLogic Server Proxy Plug-In for Third-Party Web Servers). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Weblogic Server Proxy Plug-in. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Weblogic Server Proxy Plug-in accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS