CVE-2026-60206: Unauthenticated SAML Authentication Bypass in Oracle WebLogic Server
Vulnerability ID: CVE-2026-60206
CVSS Score: 9.9
Published: 2026-07-21
A critical vulnerability (CVE-2026-60206) in Oracle WebLogic Server allows unauthenticated or low-privileged attackers to bypass SAML authentication controls. This flaw stems from improper validation of XML signatures and parsing discrepancies in SAML assertions, allowing arbitrary administrative session creation.
TL;DR
Unauthenticated SAML authentication bypass in Oracle WebLogic Server leading to administrative console access and remote code execution.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-306 / CWE-287
- Attack Vector: Network
- CVSS v3.1: 9.9
- EPSS Score: 0.00541
- Impact: Administrative Takeover / Remote Code Execution
- Exploit Status: poc
- KEV Status: Not Listed
Affected Systems
- Oracle WebLogic Server 12.2.1.4.0
- Oracle WebLogic Server 14.1.1.0.0
- Oracle WebLogic Server 14.1.2.0.0
- Oracle WebLogic Server 15.1.1.0.0
-
WebLogic Server: 12.2.1.4.0 (Fixed in:
Patch Applied) -
WebLogic Server: 14.1.1.0.0 (Fixed in:
Patch Applied) -
WebLogic Server: 14.1.2.0.0 (Fixed in:
Patch Applied) -
WebLogic Server: 15.1.1.0.0 (Fixed in:
Patch Applied)
Mitigation Strategies
- Apply Oracle July 2026 Critical Patch Update (CPU)
- Restrict access to WebLogic admin console ports (7001/7002)
- Implement Web Application Firewall (WAF) inspection rules for SAML XML payloads
Remediation Steps:
- Download the patch corresponding to your WebLogic Server version from Oracle Support.
- Use the OPatch utility to apply the patch to the WebLogic Server home directory.
- Restart the WebLogic Server domains to apply the security changes.
- Verify the patch installation using 'opatch lsinventory'.
Read the full report for CVE-2026-60206 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)