CVE-2026-60364: 
Weblogic Server Proxy Plug-in for Apache HTTP Server vulnerability analysis and mitigation

CVE-2026-60364 is an Improper Access Control vulnerability (CWE-284) in the Oracle WebLogic Server Proxy Plug-In for Third-Party Web Servers, a component of Oracle Fusion Middleware. It affects versions 12.2.1.4.0 and 14.1.2.0.0 of both Oracle WebLogic Server Proxy Plug-in and Oracle HTTP Server. The vulnerability was published on July 21, 2026, as part of Oracle's July 2026 Critical Patch Update. Feedly threat intelligence data assigns a CVSS v3.1 base score of 9.8 (Critical), while Oracle's official advisory description references a score of 7.5 (High) focused on integrity impacts — the higher score reflects the full CIA impact assessed by Feedly/ENISA (Oracle CPU Jul 2026).

The vulnerability is classified as CWE-284 (Improper Access Control), meaning the proxy plug-in component fails to properly enforce access restrictions on incoming HTTP requests. An unauthenticated attacker with network access via HTTP can exploit this flaw without any privileges or user interaction, making it highly automatable. The attack vector is entirely network-based and requires low complexity, targeting the WebLogic Server Proxy Plug-In interface used to connect third-party web servers (e.g., Apache HTTP Server, IIS) to WebLogic backends. No public proof-of-concept or detailed technical write-up has been identified at this time (Oracle CPU Jul 2026).

Successful exploitation allows an unauthenticated remote attacker to perform unauthorized creation, deletion, or modification of critical data accessible through the Oracle WebLogic Server Proxy Plug-in. The full CVSS assessment indicates potential high impacts across confidentiality, integrity, and availability, meaning an attacker could not only tamper with data but potentially access sensitive information and disrupt service availability. Given the proxy plug-in's role as a gateway between web servers and WebLogic application backends, exploitation could affect downstream application data and potentially facilitate lateral movement into the WebLogic environment (Oracle CPU Jul 2026).

There is currently no evidence of public proof-of-concept exploit code or active in-the-wild exploitation for CVE-2026-60364. The EPSS score is approximately 0.358%, indicating a low but non-negligible probability of exploitation in the near term. The vulnerability is rated as automatable by NIST SSVC analysis, meaning exploitation could be scripted at scale. It does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog at this time. Detection plugins have been released by Tenable (Nessus) and Qualys, enabling vulnerability scanning (Oracle CPU Jul 2026).

Oracle has addressed this vulnerability as part of the July 2026 Critical Patch Update (CPU). Administrators should apply the relevant patches for Oracle WebLogic Server Proxy Plug-in versions 12.2.1.4.0 and 14.1.2.0.0, and for Oracle HTTP Server versions 12.2.1.4.0 and 14.1.2.0.0, as documented in the Oracle Fusion Middleware patch availability documentation. As a temporary workaround, Oracle recommends blocking network access via HTTP to the proxy plug-in from untrusted sources using network access controls or firewalls. Oracle strongly advises against relying on network-level mitigations as a long-term solution and urges prompt patch application (Oracle CPU Jul 2026).