Vulnerability in Oracle Weblogic Server Proxy Plug-in by Oracle Fusion Middleware
CVE-2026-60365

10CRITICAL

Key Information:

Vendor

Oracle
Status
Oracle Http Server
Oracle Weblogic Server Proxy Plug-in
Vendor
CVE Published:
21 July 2026

What is CVE-2026-60365?

A vulnerability exists within the Oracle Weblogic Server Proxy Plug-in, a component of Oracle Fusion Middleware, specifically targeting version 15.1.1.0.0. This easily exploitable vulnerability allows unauthenticated attackers with network access to compromise the Proxy Plug-in through HTTP connections. Successful exploitation could lead to unauthorized creation, deletion, or modification of critical data, exposing the integral data managed by the Proxy Plug-in. The ramifications extend beyond the immediate product, potentially affecting additional systems that interact with the Proxy Plug-in. Organizations utilizing this product should prioritize immediate mitigation measures to safeguard their data.

Affected Version(s)

Oracle HTTP Server 12.2.1.4.0

Oracle HTTP Server 14.1.2.0.0

Oracle Weblogic Server Proxy Plug-in 15.1.1.0.0

References

https://www.oracle.com/security-alerts/cpujul2026.html
vendor-advisory

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.