CVE-2026-60528 Overview
CVE-2026-60528 affects the Oracle WebLogic Server product within Oracle Fusion Middleware, specifically the Console component. Supported versions 14.1.2.0.0 and 15.1.1.0.0 are affected. The flaw allows a high-privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. The vulnerability carries a scope change, meaning successful exploitation can affect resources beyond the vulnerable component. Attackers can achieve unauthorized creation, deletion, or modification of critical data alongside limited unauthorized read access.
Critical Impact
Authenticated attackers can modify or delete data across all WebLogic Server accessible resources and impact additional products through scope change.
Affected Products
- Oracle WebLogic Server 14.1.2.0.0
- Oracle WebLogic Server 15.1.1.0.0
- Oracle Fusion Middleware (Console component)
Discovery Timeline
- 2026-07-21 - CVE-2026-60528 published to NVD
- 2026-07-21 - Oracle Critical Patch Update released addressing the issue
- 2026-07-21 - Last updated in NVD database
Technical Details for CVE-2026-60528
Vulnerability Analysis
The vulnerability resides in the Console component of Oracle WebLogic Server. Oracle classifies exploitation as easy, requiring only network access over HTTP. The attacker must already hold high privileges on the server, indicating an authenticated administrative or privileged operator role is a prerequisite. Impact focuses on integrity, with high integrity impact and low confidentiality impact. Availability is unaffected. The scope change indicator signals that successful exploitation can compromise resources managed by components other than the WebLogic Console itself.
Root Cause
Oracle has not published root-cause detail in public advisories. The Console component handles administrative operations for WebLogic domains, and the flaw permits privileged users to perform actions beyond their intended authorization boundary. Consult the Oracle Critical Patch Update - July 2026 for vendor-supplied technical context.
Attack Vector
An authenticated attacker with high privileges sends crafted HTTP requests to the WebLogic Console interface. Because the attack vector is network-based and complexity is low, exploitation does not require user interaction or specialized conditions. The scope change allows the attacker to influence data or components outside the immediate WebLogic Server boundary, potentially reaching integrated Fusion Middleware products.
No public proof-of-concept code has been released. The EPSS probability sits at 0.302% as of 2026-07-23, indicating low near-term exploitation likelihood.
Detection Methods for CVE-2026-60528
Indicators of Compromise
- Unexpected administrative HTTP requests to the WebLogic Console endpoint from privileged accounts outside standard maintenance windows.
- Unauthorized creation, modification, or deletion of WebLogic configuration objects, deployments, or JNDI resources.
- Audit log entries showing privileged operations affecting resources outside the Console's expected management scope.
Detection Strategies
- Enable WebLogic auditing and forward audit logs to a centralized SIEM for correlation of privileged Console activity.
- Baseline normal administrator behavior and alert on deviations such as off-hours logins or bulk configuration changes.
- Monitor HTTP access logs for the WebLogic Console URI paths and flag anomalous request patterns from privileged sessions.
Monitoring Recommendations
- Track authentication events for accounts with WebLogic Admin, Deployer, or Operator roles.
- Alert on configuration MBean changes and MBean invocations initiated via the Console.
- Correlate WebLogic events with downstream Fusion Middleware components to detect scope-change impacts.
How to Mitigate CVE-2026-60528
Immediate Actions Required
- Apply the July 2026 Oracle Critical Patch Update to WebLogic Server 14.1.2.0.0 and 15.1.1.0.0 without delay.
- Review and reduce the number of accounts with high-privilege WebLogic roles such as Admin and Deployer.
- Rotate credentials for privileged WebLogic accounts after patching.
Patch Information
Oracle addressed CVE-2026-60528 in the July 2026 Critical Patch Update. Refer to the Oracle Critical Patch Update - July 2026 for patch identifiers, download instructions, and product-specific bulletins covering versions 14.1.2.0.0 and 15.1.1.0.0.
Workarounds
- Restrict network access to the WebLogic Administration Console using firewall rules or reverse proxy allow-lists limited to trusted management networks.
- Disable the Administration Console in production domains if it is not required for daily operations.
- Enforce multi-factor authentication for administrative accounts through the fronting identity provider or SSO integration.
- Segment WebLogic administrative interfaces from general application traffic on dedicated management VLANs.
# Disable the WebLogic Administration Console via WLST
connect('weblogic','password','t3://adminhost:7001')
edit()
startEdit()
cmo.setConsoleEnabled(false)
save()
activate()
disconnect()
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
