CVE-2026-60364: Oracle WebLogic Auth Bypass Vulnerability

CVE-2026-60364 Overview

CVE-2026-60364 affects the Oracle WebLogic Server Proxy Plug-in component within Oracle Fusion Middleware. The flaw resides in the WebLogic Server Proxy Plug-In for Third-Party Web Servers. Unauthenticated attackers can exploit the vulnerability over HTTP without user interaction. Successful exploitation grants unauthorized creation, deletion, or modification of critical data accessible to the plug-in.

Oracle disclosed the issue in the July 2026 Critical Patch Update. Affected releases include Oracle WebLogic Server Proxy Plug-in versions 12.2.1.4.0 and 14.1.2.0.0.

Critical Impact
Remote, unauthenticated attackers can modify or delete data processed by the WebLogic proxy plug-in over HTTP, breaking integrity guarantees for reverse-proxied WebLogic workloads.

Affected Products

Oracle WebLogic Server Proxy Plug-in 12.2.1.4.0
Oracle WebLogic Server Proxy Plug-in 14.1.2.0.0
Oracle Fusion Middleware deployments using the Proxy Plug-In for Third-Party Web Servers (Apache HTTP Server, IIS, iPlanet)

Discovery Timeline

2026-07-21 - CVE-2026-60364 published to the National Vulnerability Database (NVD)
2026-07-21 - Last updated in NVD database
July 2026 - Oracle addresses the issue in the Oracle Critical Patch Update Advisory - July 2026

Technical Details for CVE-2026-60364

Vulnerability Analysis

The Oracle WebLogic Server Proxy Plug-in acts as a bridge between third-party web servers such as Apache HTTP Server, Microsoft IIS, and Oracle iPlanet, and back-end WebLogic managed servers. The plug-in parses inbound HTTP requests, applies routing rules, and forwards traffic to the WebLogic cluster.

CVE-2026-60364 exposes an integrity flaw reachable over the network with no authentication and no user interaction. An attacker sends crafted HTTP traffic to a front-end web server hosting the plug-in. The plug-in mishandles the request, allowing the attacker to write, alter, or remove data that the plug-in can reach on the back end.

Because the attack traverses standard HTTP, exploitation blends with legitimate application traffic. Perimeter web application firewalls that only inspect application payloads may not distinguish malicious plug-in interactions from ordinary reverse-proxy requests.

Root Cause

Oracle has not published a public root-cause analysis. The advisory classifies the issue under the WebLogic Server Proxy Plug-In for Third-Party Web Servers component and indicates that request handling permits unauthorized state changes. Improper validation of proxied requests is consistent with the described impact.

Attack Vector

Exploitation requires only network access to the web server hosting the plug-in. The attacker crafts HTTP requests that the plug-in processes and forwards or acts upon. No credentials, session tokens, or victim interaction are needed. Successful requests result in unauthorized modification or deletion of data accessible through the plug-in.

No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-60364

Indicators of Compromise

Anomalous HTTP requests to endpoints served by mod_wl, mod_wl_ohs, or the IIS WebLogic proxy ISAPI filter
Unexpected PUT, DELETE, or state-changing methods reaching WebLogic back ends through the proxy
Plug-in log entries in wlproxy.log showing malformed headers, oversized parameters, or unusual request routing
Integrity changes to WebLogic-managed data without corresponding authenticated application events

Detection Strategies

Inspect Apache, IIS, and iPlanet access logs for HTTP requests targeting proxy-served URIs from untrusted sources
Correlate front-end web server logs with WebLogic server audit logs to identify requests that bypass application authentication
Alert on WebLogic Proxy Plug-in versions 12.2.1.4.0 and 14.1.2.0.0 running unpatched builds on internet-exposed web tiers
Baseline normal proxy traffic patterns and flag deviations in HTTP methods, header structures, or request rates

Monitoring Recommendations

Forward web server and WebLogic logs to a centralized SIEM for cross-correlation and retention
Monitor file and configuration integrity on hosts running the proxy plug-in
Track outbound behavior from WebLogic managed servers for signs of data tampering following proxy requests

How to Mitigate CVE-2026-60364

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all WebLogic Server Proxy Plug-in installations
Inventory every Apache HTTP Server, IIS, and iPlanet host running mod_wl, mod_wl_ohs, or the WebLogic ISAPI filter
Restrict network exposure of front-end web servers hosting the plug-in to trusted networks where feasible
Review web server and WebLogic logs for prior suspicious proxy activity

Patch Information

Oracle addresses CVE-2026-60364 in the Oracle Critical Patch Update Advisory - July 2026. Administrators must download the updated plug-in binaries for their target web server platform and redeploy them alongside affected WebLogic 12.2.1.4.0 and 14.1.2.0.0 environments. Restart the front-end web server process after replacing the plug-in module.

Workarounds

Place a hardened reverse proxy or web application firewall in front of the WebLogic plug-in and enforce strict HTTP method and URI allow-lists
Disable the WebLogic Proxy Plug-in on web servers where it is not required
Restrict inbound HTTP access to management and administrative URIs using network ACLs
Enable verbose plug-in logging (Debug=ALL, DebugConfigInfo=ON) temporarily to aid identification while patching is in progress

bash

# Example: restrict WebLogic proxy locations in Apache httpd.conf
<Location /weblogic>
    SetHandler weblogic-handler
    WebLogicCluster wls1.internal:7003,wls2.internal:7003
    # Allow only trusted upstream networks
    Require ip 10.0.0.0/8
    # Restrict HTTP methods to those the application requires
    <LimitExcept GET POST>
        Require all denied
    </LimitExcept>
</Location>