VulnSocial

CVE-2026-60206PoC(oracle / weblogic_server)

MEDIUMCVSS 9.9 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

  • Patch oracle weblogic_server systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SAML to compromise Oracle WebLogic Server. While the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

oracle CVEsBack to dashboard
4.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-306

Priority

MEDIUM

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • weblogic_server

Threat summary

  • Public PoC and exploit tooling are both present
  • Patch or workaround signal is available
  • 12 mentions across 7 observed days
  • Momentum state: stable

What's happening

  • Exploit tool or code specified in 5 signals
  • PoC mentioned or linked in 6 signals
  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 9 signals
  • Disclosure: 2 classified signals
  • Peaked 4d ago at 4 mentions (2026-07-24); latest day: 1
  • 12 total mentions across 7 days

Affected systems

Vendors
oracle
Products
weblogic_server

4 versions affected across 1 product

Deep dive

Activity timeline12 mentions / 7d
01234Mentions · 2026-07-22: 1Mentions · 2026-07-23: 2Mentions · 2026-07-24: 4Mentions · 2026-07-31: 1Mentions · 2026-08-01: 1Mentions · 2026-08-02: 2Mentions · 2026-08-19: 1PoC Mentioned / Linked · 2026-07-24: 3PoC Mentioned / Linked · 2026-07-31: 1PoC Mentioned / Linked · 2026-08-01: 1PoC Mentioned / Linked · 2026-08-02: 1Exploit Tool / Code · 2026-07-24: 3Exploit Tool / Code · 2026-08-01: 1Exploit Tool / Code · 2026-08-02: 1Patch / Workaround · 2026-07-22: 1Patch / Workaround · 2026-07-31: 1Technical Details · 2026-07-22: 1Technical Details · 2026-07-23: 1Technical Details · 2026-07-24: 4Technical Details · 2026-08-01: 1Technical Details · 2026-08-02: 1Technical Details · 2026-08-19: 107-2207-2307-2407-3108-0108-0208-19
Signal classification5 categories
PoC
433.3%
Patch
325.0%
Disclosure
216.7%
General
216.7%
Exploit
18.3%
Referenced assets11 URLs
Classification over time
DateTotalLabels
2026-07-221
Patch1
2026-07-232
Disclosure1General1
2026-07-244
Disclosure1Exploit1PoC2
2026-07-311
Patch1
2026-08-011
PoC1
2026-08-022
General1PoC1
2026-08-191
Patch1
Full discourse12 posts
  • st8le̤̤̤̤̤̤̤̤̤̤ss@st8less
    PoC

    CVE-2026-60206 | CVSS 9.9 Oracle WebLogic SAML Auth Bypass PoC https://github.com/imbas007/POC-CVE-2026-60206

    Post summary

    The snippet announces a proof‑of‑concept for CVE-2026-60206, an Oracle WebLogic SAML authentication bypass rated CVSS 9.9, and supplies a GitHub link to the PoC code.

    154218210515.2K
    661 followersView on X
  • ZoomEye@zoomeye_team
    Disclosure

    🚨 CVE-2026-60206: Oracle WebLogic Server Arbitrary File Read Critical Vulnerability Alert! Oracle WebLogic is affected by CVE-2026-60206. Full Vulnerability Details & Analysis at DarkEye: 🔗 https://darkeye.org/vuln/cve/CVE-2026-60206 🔍 Identify Targets via ZoomEye: Filter: vul.cve="CVE-2026-60206" Search Dork: app="Oracle WebLogic" Exposure: 1.2m instances identified globally. ZoomEye Search Link: 👉 https://www.zoomeye.ai/searchResult?q=YXBwPSJPcmFjbGUgV2ViTG9naWMi&t=all&utm_source=twitter&utm_medium=social&utm_campaign=cve_ops_20260723 #Infosec #CyberSecurity #ZoomEye #DarkEye

    Post summary

    The tweet announces a critical Oracle WebLogic arbitrary file read vulnerability (CVE‑2026‑60206), points to DarkEye for full details, and shows the breadth of exposed instances via a ZoomEye search.

    23711134412.7K
    12.7K followersView on X
  • ThreatWire@ThreatWire_
    PoC

    🚨 A public PoC has been released for CVE-2026-60206 affecting Oracle WebLogic Server. The flaw allows a low-privileged network attacker to compromise vulnerable servers via SAML, potentially leading to full server takeover. 🔗 https://github.com/imbas007/poc-cve-2026-60206 #Oracle #WebLogic #CVE

    Post summary

    A public PoC for CVE-2026-60206 in Oracle WebLogic Server has been released, demonstrating that a low-privilege network attacker can gain full server takeover through SAML.

    029088499.3K
    1.4K followersView on X
  • dbugs@ptdbugs
    Exploit

    A PoC/exploit has been discovered for vulnerability CVE-2026-60206 PT ID: PT-2026-62288 Vendor: Oracle Corporation Product: Oracle WebLogic Server Description: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SAML to compromise Oracle WebLogic Server. While the vulnerability is in Oracle WebLogic Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. References: • https://dbugs.ptsecurity.com/vulnerability/PT-2026-62288 • https://github.com/imbas007/poc-cve-2026-60206 #dbugs_vuln

    Post summary

    A Proof of Concept and exploit code for CVE-2026-60206 targeting Oracle WebLogic Server has been published, demonstrating that the vulnerability is easily exploitable by low‑privileged attackers via SAML.

    00062757
    3.4K followersView on X
  • Daily CyberSecurity@Daily_CyberSec
    Patch

    Oracle's July 2026 patch fixes 11 Oracle WebLogic Server vulnerabilities. CVE-2026-60206 rates CVSS 9.9 and allows full server takeover. Patch now. #OracleWebLogic #CVE202660206 #WebLogicServer #OracleCPU #RCE #InfoSec http://securityonline.info/oracle-weblogic-server-vulnerability-cve-2026-60206/

    Post summary

    The post announces that Oracle has released a patch for CVE‑2026‑60206, a high‑severity WebLogic Server vulnerability allowing full server takeover, and provides basic technical details.

    01021482
    12.9K followersView on X
  • CCB Alert@CCBalert
    Patch

    Warning: Multiple (100+) vulnerabilities in #Oracle #WebLogic Server Fusion Middleware. #CVE-2026-60206 #CVE-2026-61211 #CVE-2026-47040 #CVE-2026-4738. There are publicly available proof-of-concepts #PoC See advisory https://www.oracle.com/security-alerts/cpujul2026.html #Patch #Patch #Patch

    Post summary

    The post warns of more than 100 Oracle WebLogic vulnerabilities, confirms publicly available PoCs, and emphasizes that patches are available via Oracle’s advisory.

    00011390
    7.2K followersView on X
  • d4rk_c0r3@d4rk_c0r3
    PoC

    POC CVE-2026-60206 : Oracle WebLogic Server Arbitrary File Read https://github.com/imbas007/POC-CVE-2026-60206

    Post summary

    A GitHub repository shares a proof‑of‑concept code for CVE‑2026‑60206, demonstrating an arbitrary file read in Oracle WebLogic Server; no evidence of active exploitation or patch information is provided.

    00011133
    155 followersView on X
  • セキュリティ対策Lab@securityLab_jp
    Disclosure

    Oracle WebLogic Serverに11件の深刻な脆弱性-最大CVSS 9.9のCVE-2026-60206はスコープ変更で他製品にまで影響 https://rocket-boys.co.jp/security-measures-lab/oracle-weblogic-cve-2026-60206-critical-vulnerability/ #セキュリティ対策Lab #security #securitynews #脆弱性

    Post summary

    The post announces the discovery of 11 critical vulnerabilities in Oracle WebLogic Server, including CVE‑2026‑60206 with a CVSS score of 9.9 and a scope change affecting other products.

    01010200
    493 followersView on X
  • IntegSec@integ_sec
    Patch

    CVE-2026-60206: Oracle WebLogic Server Authentication Bypass via SAML - What It Means for Your Business and How to Respond https://hubs.li/Q04tyWrZ0

    Post summary

    The article alerts on an authentication bypass flaw in Oracle WebLogic Server’s SAML integration and advises readers to take defensive measures, likely including patching and configuration review.

    0000040
    33 followersView on X
  • HairIron@hairir0n
    General

    CVE-2026-60206 weblogic をつかい続け、samlまで到達するぐらい使い倒してるで、希少価値が高いと思われます

    Post summary

    The tweet references CVE-2026-60206 but provides no actionable information on PoC, exploitation, patching, or technical specifics.

    00000112
    606 followersView on X
  • ♤ ʂa𝖑𝖙𝖎n𝖇a𝖓ӄ ♤ DEADSEC ♤ Baroud d'honneur ♤@SaltinDeadsec
    PoC

    https://github.com/rootsecdev/POC-CVE-2026-60206

    Post summary

    The GitHub repository hosts a proof‑of‑concept exploit for CVE‑2026‑60206, providing functional code and technical details but no indication of active exploitation or mitigation.

    0000075
    377 followersView on X
  • takenaka hiroya@Joe_Biden_ja
    General

    Oracle WebLogic Server (Core) の脆弱性 CVE-2026-60206 について記事を更新しました。CVSS 9.9の評価です。ご確認の上、早めの対策をご検討ください。 https://cve.autoarticles.net/cve/CVE-2026-60206

    Post summary

    The article updates on the Oracle WebLogic Server CVE-2026-60206, noting a CVSS score of 9.9 and encouraging prompt mitigation, but provides no further technical or exploit details.

    0000074
    561 followersView on X
CPE platform detail4 entries

4 of 4 entries

PartVendorProductVersionTarget SWTarget HW
Apporacleweblogic_server12.2.1.4.0--
Apporacleweblogic_server14.1.1.0.0--
Apporacleweblogic_server14.1.2.0.0--
Apporacleweblogic_server15.1.1.0.0--

Explore more

Back to dashboardoracle CVEsweblogic_server vulnerabilities