CVE-2026-60365 Overview
CVE-2026-60365 is a critical vulnerability in the Oracle WebLogic Server Proxy Plug-in component of Oracle Fusion Middleware. The flaw affects the WebLogic Server Proxy Plug-In for Third-Party Web Servers in version 15.1.1.0.0. An unauthenticated attacker with network access via HTTP can compromise the proxy plug-in without user interaction. Successful exploitation results in unauthorized creation, deletion, or modification of critical data, and full read access to all accessible data. The scope changes during exploitation, meaning attacks can significantly impact additional products beyond the vulnerable component itself.
Critical Impact
Unauthenticated network-based compromise of Oracle WebLogic Server Proxy Plug-in with cross-component impact on confidentiality and integrity.
Affected Products
- Oracle Fusion Middleware — Oracle WebLogic Server Proxy Plug-in
- WebLogic Server Proxy Plug-In for Third-Party Web Servers
- Affected version: 15.1.1.0.0
Discovery Timeline
- 2026-07-21 - CVE-2026-60365 published to the National Vulnerability Database
- 2026-07-23 - Last updated in the NVD database
Technical Details for CVE-2026-60365
Vulnerability Analysis
The vulnerability resides in the Oracle WebLogic Server Proxy Plug-In for Third-Party Web Servers. This plug-in is deployed on third-party web servers such as Apache HTTP Server or Microsoft IIS to forward requests to a WebLogic Server backend. The flaw is remotely exploitable over HTTP by an unauthenticated attacker and requires no user interaction. The vulnerability produces a scope change, meaning exploitation of the plug-in can impact components outside its own security authority, including backend WebLogic Server instances and other integrated Fusion Middleware services. Successful exploitation yields high confidentiality and integrity impact, giving attackers the ability to read, modify, or delete data accessible through the proxy plug-in.
Root Cause
Oracle has not publicly disclosed the underlying defect class in its advisory. The observable behavior — unauthenticated HTTP-based compromise with a security scope change — is consistent with weaknesses in how the plug-in parses or forwards HTTP request data between the third-party web server and the WebLogic Server backend. Refer to the Oracle Security Alert July 2026 for authoritative technical details.
Attack Vector
The attack vector is HTTP over the network. An attacker sends specially crafted HTTP requests to any third-party web server hosting the vulnerable proxy plug-in. Because authentication is not required and attack complexity is low, exploitation can be automated at scale against internet-exposed web servers that proxy to WebLogic backends. The scope change indicates that a successful attack against the plug-in can pivot into the backend WebLogic environment or adjacent integrated systems.
No verified proof-of-concept code has been published at the time of writing. See the vendor advisory linked above for exploit availability updates.
Detection Methods for CVE-2026-60365
Indicators of Compromise
- Anomalous or malformed HTTP requests targeting proxy endpoints that forward to WebLogic Server backends.
- Unexpected outbound connections or process activity originating from third-party web servers running the WebLogic proxy plug-in.
- Modifications to data or configuration accessible through the proxy that cannot be tied to legitimate application flows.
Detection Strategies
- Inventory all Apache HTTP Server, Microsoft IIS, and other third-party web servers running the WebLogic Server Proxy Plug-In version 15.1.1.0.0.
- Deploy web application firewall rules to identify malformed or oversized headers, unusual URI structures, and abnormal request smuggling patterns targeting proxy endpoints.
- Correlate web server access logs with backend WebLogic audit logs to identify requests that produce unexpected privileged operations.
Monitoring Recommendations
- Enable verbose logging on the WebLogic proxy plug-in and forward logs to a centralized analytics platform for anomaly detection.
- Monitor for spikes in 5xx responses, connection resets, or process crashes on web servers hosting the plug-in.
- Alert on new outbound network sessions from web server hosts to unexpected destinations following inbound HTTP traffic.
How to Mitigate CVE-2026-60365
Immediate Actions Required
- Apply the patches referenced in the Oracle Security Alert July 2026 as soon as they are validated in a test environment.
- Identify all instances of the WebLogic Server Proxy Plug-In version 15.1.1.0.0 on third-party web servers and prioritize internet-exposed hosts.
- Restrict inbound HTTP access to affected web servers using network ACLs, WAF policies, or reverse proxy allowlists until patches are deployed.
Patch Information
Oracle addresses this vulnerability in its July 2026 Critical Patch Update cycle. Refer to the Oracle Security Alert July 2026 for the exact patch identifiers, download locations, and installation guidance for the WebLogic Server Proxy Plug-In.
Workarounds
- Disable the WebLogic Server Proxy Plug-In on third-party web servers where it is not strictly required for application delivery.
- Place a hardened reverse proxy or WAF in front of vulnerable web servers to filter malformed HTTP requests targeting proxy endpoints.
- Segment backend WebLogic Server instances so that a compromised proxy host cannot reach adjacent Fusion Middleware components.
# Example: temporarily disable the WebLogic proxy module on Apache HTTP Server
# until the Oracle July 2026 CPU patch is applied.
a2dismod weblogic
systemctl restart apache2
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
