CVE-2026-60293: Oracle WebLogic Server Info Disclosure

CVE-2026-60293 Overview

CVE-2026-60293 is a high-severity vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware, specifically within the WLS - Web Services component. The flaw affects supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. An unauthenticated attacker with network access via HTTP can exploit this vulnerability without user interaction. Successful exploitation results in unauthorized access to critical data or complete access to all WebLogic Server accessible data. The vulnerability carries a scope change, meaning attacks may significantly impact additional products beyond WebLogic Server itself.

Critical Impact
Unauthenticated remote attackers can compromise data confidentiality across WebLogic Server and adjacent products through crafted HTTP requests to the Web Services component.

Affected Products

Oracle WebLogic Server 12.2.1.4.0
Oracle WebLogic Server 14.1.1.0.0
Oracle WebLogic Server 14.1.2.0.0 and 15.1.1.0.0

Discovery Timeline

2026-07-21 - CVE CVE-2026-60293 published to NVD as part of Oracle Critical Patch Update July 2026
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60293

Vulnerability Analysis

The vulnerability resides in the Web Services component of Oracle WebLogic Server. WebLogic exposes Web Services over HTTP endpoints that process SOAP and REST requests. An unauthenticated attacker can send crafted HTTP requests to these endpoints to gain unauthorized read access to sensitive data. The scope change indicator means the impact extends beyond the vulnerable component's security authority, potentially exposing data belonging to other integrated Oracle Fusion Middleware products. The flaw affects confidentiality without impacting integrity or availability, suggesting an information disclosure primitive rather than code execution.

Root Cause

Oracle has not published detailed root cause information in the public advisory. The vulnerability class aligns with information disclosure through improper access control in Web Services processing. See the Oracle Security Alert July 2026 for vendor-supplied technical details available to licensed customers.

Attack Vector

Exploitation requires only network access to a WebLogic Web Services HTTP endpoint. No authentication, privileges, or user interaction are required. Attackers target reachable T3, HTTP, or HTTPS listeners exposing SOAP or REST services. Internet-facing WebLogic deployments face the highest risk, though internal deployments remain exploitable from any network-connected host with reachability. The Exploit Prediction Scoring System (EPSS) rates this vulnerability at 0.398%.

No verified public exploitation code is currently available. Refer to the Oracle Security Alert July 2026 for authoritative technical guidance.

Detection Methods for CVE-2026-60293

Indicators of Compromise

Unexpected HTTP or HTTPS requests to WebLogic Web Services endpoints such as /ws_utc/, /wls-wsat/, or custom SOAP service paths from unfamiliar source addresses.
Anomalous outbound data transfers from WebLogic managed servers following inbound Web Services traffic.
WebLogic access logs showing repeated requests with malformed SOAP envelopes or unusual XML payloads.

Detection Strategies

Inspect WebLogic access logs and application server audit trails for unauthenticated requests to Web Services URIs, particularly those returning large response bodies.
Deploy WAF or IDS rules that identify anomalous SOAP request patterns targeting wls-wsat, bea_wls_internal, and related WebLogic paths.
Correlate HTTP request spikes to WebLogic endpoints with process behavior on the host to identify data exfiltration attempts.

Monitoring Recommendations

Enable verbose access logging on all WebLogic HTTP channels and forward logs to a centralized SIEM for retention and correlation.
Alert on any traffic to WebLogic Web Services endpoints from sources outside expected integration partners.
Track outbound egress volume from WebLogic hosts and baseline normal Web Services traffic to detect deviations.

How to Mitigate CVE-2026-60293

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all affected WebLogic Server instances immediately.
Inventory all WebLogic deployments running 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, or 15.1.1.0.0 and prioritize internet-facing systems.
Restrict network access to WebLogic administrative and Web Services ports using firewall rules and network segmentation.

Patch Information

Oracle addressed CVE-2026-60293 in the July 2026 Critical Patch Update. Administrators should download and apply the vendor patch bundle referenced in the Oracle Security Alert July 2026. Verify patch application by checking the WebLogic patch inventory using bsu.sh or OPatch tooling appropriate to the installed version.

Workarounds

Disable the wls-wsat and bea_wls_internal Web Services subsystems if they are not required by production applications.
Place WebLogic servers behind a reverse proxy or WAF configured to block requests to non-essential Web Services URIs.
Enforce mutual TLS or network ACLs limiting Web Services consumers to a defined allow-list of client hosts.

bash

# Example: block external access to WebLogic Web Services paths via reverse proxy
location ~ ^/(wls-wsat|ws_utc|bea_wls_internal) {
    allow 10.0.0.0/8;
    deny all;
    return 403;
}