CVE-2026-60364: 
Weblogic Server Proxy Plug-in for Apache HTTP Server vulnerability analysis and mitigation

CVE-2026-60364 is a data integrity vulnerability in the Oracle WebLogic Server Proxy Plug-In for Third-Party Web Servers, a component of Oracle Fusion Middleware. It affects versions 12.2.1.4.0 and 14.1.2.0.0 of both Oracle WebLogic Server Proxy Plug-in and Oracle HTTP Server. The vulnerability was disclosed on July 21, 2026, as part of Oracle's July 2026 Critical Patch Update. The official Oracle advisory assigns a CVSS 3.1 Base Score of 7.5 (High, integrity impacts only), though Feedly's aggregated scoring reflects 9.8 (Critical) based on a broader vector assessment (Oracle CPU Jul 2026).

The vulnerability resides in the WebLogic Server Proxy Plug-In component used with third-party web servers (e.g., Apache HTTP Server, IIS), which acts as a reverse proxy forwarding requests to WebLogic backend servers. The root cause is improper input handling or request validation within the plug-in's HTTP processing logic, enabling an unauthenticated attacker to manipulate data in transit or directly affect backend data integrity. This aligns with CWE-20 (Improper Input Validation) or a related tampering weakness. No authentication or user interaction is required, and the attack is conducted over HTTP from any network-accessible location (Oracle CPU Jul 2026).

Successful exploitation allows an unauthenticated remote attacker to perform unauthorized creation, deletion, or modification of critical data accessible through the Oracle WebLogic Server Proxy Plug-in. The primary impact is on data integrity, with no direct confidentiality or availability impact per Oracle's official scoring. However, the ability to tamper with critical data could have downstream consequences for applications relying on the WebLogic infrastructure, potentially enabling further compromise of backend systems or data corruption at scale (Oracle CPU Jul 2026).

Oracle strongly recommends applying the patches released as part of the July 2026 Critical Patch Update for affected versions 12.2.1.4.0 and 14.1.2.0.0 of Oracle WebLogic Server Proxy Plug-in and Oracle HTTP Server. As a temporary workaround prior to patching, Oracle suggests restricting network access to the proxy plug-in via firewall rules or network ACLs to limit HTTP access to trusted sources only. Monitoring for unauthorized data modifications and implementing integrity checks on critical data are also recommended interim measures. Oracle does not consider network-level blocking a long-term solution and advises patching as soon as possible (Oracle CPU Jul 2026).